- While regulators and patient advocacy groups alike have been pushing for improved EHR patient data access in recent months, a new Government Accountability Office (GAO) report found some patients still run up against hefty fees or reluctant providers when attempting to gain access to their own electronic health records.
In an effort to gain insight into the process for granting patient access to EHRs, GAO interviewed four provider associations, seven EHR vendors that work for providers, and six patient advocates, as well as state and HHS officials.
“Available information suggests that the fees charged for accessing medical records can vary depending on the type of request and the state in which the request is made,” noted GAO in the report.
Under current HIPAA regulations, providers are authorized to charge a “reasonable, cost-based fee” when patients request copies of their EHRs or request that their health records be forwarded to another provider or healthcare organization, GAO stated.
Patients can also grant third parties access to their health information. Fees for third party access to EHRs are not subject to the reasonable cost-based standard and are instead governed by state law.
“According to stakeholders GAO interviewed, the fees for third-party requests are generally higher than the fees charged to patients and can vary significantly across states,” noted GAO investigators.
GAO reviewed laws about patient and third party access to EHRs in Kentucky, Ohio, Rhode Island, and Wisconsin.
Ohio, Rhode Island, and Wisconsin charged fees per page for patient and third party record requests. The amount charged per page varied between each of the three states.
“One of the three states has established a different per-page fee amount for third-party requests. The other two do not authorize a different fee for patient and third-party requests,” wrote GAO.
“One of the three states also specifies a maximum allowable fee if the provider uses an electronic health records system,” investigators continued. “The other two do not differentiate costs for electronic or paper records.”
Meanwhile, GAO investigators found Kentucky state law allowed patients one free copy of their EHR, followed by a charge of up to $1 per page for additional copies.
“We found that some patients incurred fees they believed to be excessive to access their records; for example, patients with chronic conditions can have lengthy records, and copying costs can be significant,” stated GAO in a summary of the report.
In addition to excessive fees, some patients also reported being unaware they had a right to challenge providers who denied them access to their own medical information.
“Stakeholders we interviewed also noted that patients themselves are not always aware of their right to access their medical records, do not always know that they can submit a formal complaint to HHS’s OCR when denied access, and could benefit from specific educational efforts that raise awareness of these issues,” wrote GAO.
Providers run up against their own share of challenges when attempting to grant patients access to their EHRs.
“Providers’ challenges include the costs of responding to patient requests for records due to the allocation of staff time and other resources,” stated GAO.
Return on investment (ROI) vendors, and patient advocates, healthcare organization staff may lack the expertise necessary for responding to medical records requests in a HIPAA-compliant way, interviewed provider representatives explained.
While providers can request training about HIPAA compliance issues, a patient advocate told GAO investigators this training often focuses primarily on health IT security issues rather than patient rights to health data.
“In addition, according to provider associations and others GAO interviewed, fulfilling requests for medical records has become more complex and challenging for providers, in part because providers may store this information in multiple electronic record systems or in a mix of paper and electronic records,” investigators wrote.
Despite existing problems with interoperability and disparate sources of paper and electronic medical records, most stakeholders stated EHR systems have made medical record access easier and less expensive for patients on the whole.
“For example, multiple stakeholders we interviewed told us that an increase in the use of patient portals has reduced the number of patient requests for access to their medical records because patients are able to directly access some health information through the portals,” noted GAO.
While patient portals do not always include complete patient health records, patients reported benefitting from the health information available online.
“The use of patient portals has not eliminated patient requests for access to their medical records; a provider representative we interviewed said that many patients still prefer to obtain paper copies of their records,” investigators maintained.
In an effort to improve patient access to EHRs, OCR provides educational materials to patients and providers about patient rights to medical records. Additionally, OCR investigates complaints about patient access to medical records, audits a sample of providers to determine HIPAA compliance of existing policies and procedures, and reports to Congress about the state of HIPAA compliance among providers.
The Trump Administration has also taken steps to improve EHR patient data access through the new MyHealthEData initiative. The initiative is intended to give patients more control over their own EHR data by breaking down existing barriers to health data access and use.
For its part, CMS is requiring providers to update their systems with health data exchange capabilities and mandating that providers enable a patient’s health data to follow them after they are discharged from the hospital.
These efforts to boost EHR patient data access will help to improve patient engagement and enable shared decision-making between patients and providers.