Interplay of HIPAA and Washington's Medical Records Statutes and Regulations
HIPAA will pre-empt state laws governing medical record privacy and security unless the state law is more strict. Nevertheless, it is not always clear by what parameters the "strict" nature of one statute over another is judged. HIPAA vs. UHCIA provisions deal with access to medical records, copies and use of process to obtain records. In this article, we are limiting the discussion to cost of healthcare record copies.
“RCW 70.02.010(15) allows medical providers to charge fees for searching and duplicating medical records. The fees a provider may charge cannot exceed the fees listed below:
(1) Copying charge per page:
Covered entities are now mandated to follow HIPAA copy protocols. Providers need to take into account that HIPAA cost charging provisions will pre-empt this provision with respect to covered entities. The pro-HIPAA argument arises from (1) HIPAA pre-emption, (2) specific reference to HIPAA in subsection 4 above, and (3) restrictions on copy charges to "patients". Since HIPAA "covered entity" status has been expanded to include healthcare entities which "store" patient healthcare information electronically, unless the provider operates a low tech facility, HIPAA copy charges will be applicable.
45 CFR 164.524 (c) (4) states:
"If the individual requests a copy of the protected health information or agrees to a summary or explanation of such information, the covered entity may impose a reasonable, cost-based fee, provided that the fee includes only the cost of:
(i) Copying, including the cost of supplies for and labor of copying, the protected health information requested by the individual;
(ii) Postage, when the individual has requested the copy, or the summary or explanation, be mailed, and;
(iii) Preparing an explanation or summary of the protected health information, if agreed to by the individual as required by paragraph 164.524 c(2)(ii)".
Section 164.524(c)(2)(ii) essentially pertains to mutual agreement over preparing a summary or explanation.
The first argument obviously arises over the "cost" of materials and labor. Certainly geographic and professional differences can account for some deviation, but it is unlikely that many practitioners have taken the time to actually compute their "cost" of copying medical records. One argument which has been raised is based upon 42 CFR 476.78, a section that relates to what hospitals can charge the government for copying records necessary for "Q10" reviews. The foregoing regulations sets for the methodology for determining cost-based charge for copying at 42 CFR 476.78(c). This subsection states:
“(c) Photocopying reimbursement methodology for prospective payment system providers. Providers subject to the prospective payment system are paid for the photocopying costs that are directly attributable to the providers' responsibility to the QIOs to provide photocopies of requested provider records. The payment is in addition to payment already provided for these costs under other provisions of the Social Security Act and is based on a fixed amount per page as determined by CMS as follows:
(2) Step two. CMS divides the amount determined in paragraph (c)(1) of this section by the number of pages that can be reasonably expected to be made annually by the photocopy machine operator to establish the labor cost per page.
In 1992, pursuant to that methodology, the U.S. government issued a final rule on October 20, 1992, in the Federal Register (57 FR 47779) which established a fee of 7 cents per copy. This rate was revised by CMS in December 2003 to 12 cents per copy. This is only for PPS hospitals but the methodology would seem analogous. Obviously, whether these hospital based "costs" are applicable to individual practitioners and small clinics remains debatable. However, the methodology was challenged by the hospitals in QUEEN OF ANGELS/HOLLYWOOD PRESBYTERIAN MEDICAL CENTER v. SHALALA, 65 F3d 1472 (9th Cir., 1995) and was upheld.
First, recognize that the prohibition on costs pertains to making copies for the requesting individual which is referring to the "patient" or their designated representatives. Clearly requests for records from defense lawyers or their agents are not requests from the patient, e.g. subpoenas, but may be requests from the patient when they have an authorization. With subpoenas, it could be argued to charge the state authorized level for those copies. Copy requests from plaintiff attorneys (or their agents) are a different matter because plaintiff's attorneys are the agents for the patient and are obtaining the records for patient use.
45 CFR 164 does state that state law “ per page copy fee charges” are presumed reasonable unless they include costs excluded under this rule. This preamble also states that the cost of retrieving or handling the information are not acceptable under the rule. WAC Section 2(b) above appears pre-empted. However, since HIPAA does not address file review by the provider to edit out confidential information when required by statute, one could argue that when such editing by the provider is required by statute (and it is not always so required except in the mental health, HIV, etc. or by the terms of the HIPAA release) a provider can charge an office visit charge. However, this review would also seem to fall within Section 164.524 and must be negotiated between the parties.
Inquiries to the Department of Health did not turn up any cost studies that supported the current state and WAC charges. A review of the legislative history at the State Archives also failed to uncover any such cost studies. The original 1991 statute contemplated charges at "actual cost" but not more than the court's copy charges. Vendors and interested parties complained that this "either/or" situation was confusing, so in 1993 the statute was changed and the current system of biennial updates based on the Consumer Price Index was instituted.
Copy Services? It would also appear that the prohibitions of this section apply to covered entities, and not third parties, such as copy services. However, if the covered entity contracts with a copy service, presumably the individual cannot be charged more than what the covered entity can charge. The HITECH amendments to HIPAA arising in the February 2009 ARRA bill (stimulus) apply HIPAA directly to covered entity "business associates" so copy vendors or management companies working with covered entities have to follow HIPAA copy charge protocols. In short, a new (or old) day is dawning on copy charges, and more attorneys will be getting up to speed on this HIPAA provision.