Q&A: Patient requests for copies of medical record

Q: If a patient requests copies of his or her medical record, which is allowed by the Privacy Rule, is the patient required to pay for the copies?

A: Yes, providers are permitted to charge the cost of preparing the record. This was addressed in the right to access guidance issued by OCR. Per OCR, “The Privacy Rule permits a covered entity (CE) to impose a reasonable, cost-based fee if the individual requests a copy of the PHI (or agrees to receive a summary or explanation of the information).” If patients request to view, versus obtain, a copy of their designated record set (DRS), CEs cannot charge patients for this service.

Editor's note: This question was answered by Chris Apgar, CISSP. Apgar is president of Apgar & Associates, LLC, in Portland, Oregon. He is also a BOH editorial advisory board member. This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions. Opinions expressed are those of the author and do not represent HCPro or ACDIS. Email your HIPAA questions to editor Heidi Samuelson at hsamuelson@hcpro.com.