Q&A: Third-party charges for medical records

Q: HHS recently issued a notice that fee limitations will apply only to an individual’s request for access to their own records and not to an individual’s request to transmit records to a third party. Will limitations imposed by state law now apply?

A: As a general statement, state limitations already likely apply, but this will require examination of your state’s laws when it comes to what you can charge for a copy of an individual’s designated record set (DRS). Most state laws set what individuals may be charged, but do not include requirements around what covered entities (CE) may charge third parties. As an example, Oregon law sets the maximum amount individuals can be charged for a copy of their DRS, but it does not set a limit on what you can charge third parties for a copy of an individual’s DRS.

That said, when it comes to what individuals may be charged, you need to keep in mind that state law may permit CEs to charge more than what the Office for Civil Rights permits. You may only charge an individual what is permitted by state law or HIPAA, whichever is less. This, again, has little bearing on what third parties may be charged for a copy of a DRS.

Editor's Note: This question was answered by Chris Apgar, CISSP in the March issue of Briefings on HIPAA.