On December 10, 2020, the Department of Health and Human Services published a Notice of Proposed Rulemaking (NPRM) aimed at modifying the HIPAA Privacy Rule. The NPRM addresses a wide range of issues affected by the Privacy Rule, but, naturally, we took special note of the proposals affecting the right of patients to access their protected health information (PHI) under 45 C.F.R. § 164.524. Generally, any measure that enhances this right is helpful to plaintiffs, but the proposals to do the following stood out as particularly plaintiff-friendly:
- Reducing the amount of time for a healthcare provider (HCP) to respond to a medical record request;
- Prohibiting HCPs from imposing unreasonable identity verification measures;
- Relaxing the requirements for submitting third-party directives; and
- Requiring HCPs to provide itemizations of charges for medical records.
Time limits: currently, HCPs have 30 days to respond to a patient’s request for records, with the possibility of one 30-day extension. The proposed rule cuts that time in half (and more); it requires HCPs to provide records “as soon as practicable,” but no later than 15 days after receipt of the request, with the possibility of one 15-day extension.
While many HCPs already provide records within the current 30-day window, they usually don’t do so within 15 days, and probably not “as soon as practicable.” Thus, this proposal could increase the rate at which cases can be evaluated and filed, and, in some urgent situations, it could mean the difference between meeting or missing an important deadline.
Identity verification measures: HHS made this proposal after receiving complaints about burdensome identity verification measures imposed by some HCPs, such as requiring the individual to request her records in person or have her written request notarized. Accordingly, HHS has proposed to prohibit HCPs from imposing “unreasonable” identity verification measures, which it describes as those that “require an individual to expend unnecessary effort or expense when a less burdensome verification measure is practicable.”
We’ve experienced some of these unreasonable measures firsthand. Not only do they result in unnecessary hassle and frustration, they add days or even weeks to the time it takes to get the records. Thus, the proposed prohibition will benefit plaintiffs in both ways.
Third-party directives: currently, third-party directives must be “in writing, signed by the individual, and clearly identify the designated person and where to send the copy of the PHI.” HHS proposes to eliminate this requirement and require only that the directive be “clear, conspicuous, and specific,” meaning that the directive can be made orally or in writing, and with or without a signature.
The benefit of this proposal is easy to see: it would increase the efficiency and convenience of submitting third-party directives to HCPs and thus make plaintiffs’ lives a bit easier.
Itemizations: HHS proposes that, upon request of the individual, HCPs provide “an itemization of the charges for labor for copying, supplies, and postage, as applicable.” We hope that this would require HCPs to state the amount of time spent and describe the work performed to copy electronic PHI. Currently, this type of information is often (and conveniently) omitted on invoices for medical records.
If adopted, this proposal would give plaintiffs the power to verify that the fees they’re paying for medical records comport with 45 C.F.R. § 164.524(c)(4), as well as the fees for third-party directives proposed in the NPRM (discussed in our previous post).
Although the NPRM hasn’t been formally published yet, once that happens, the 60-day comment period will open. If you’re interested in submitting comments on these or other proposals in the NPRM, search Docket ID number HHS-OCR-0945-AA00 on the Federal Register website and follow the appropriate instructions.
About Post Author
