The GetMyHealthData Campaign is commending the U.S. Department of Health and Human Services (HHS) for offering new guidance on patients’ rights to access their health records under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. The GetMyHealthData Campaign, which launched in July 2015, is a collaborative effort of leading consumer organizations, health care experts, former policymakers and technology organizations working to enhance consumer access to digital health information.

“The guidance released yesterday is an important step forward in helping patients exercise their right to access their health information under HIPAA, including electronically. Our cadre of volunteer ‘Tracer’ patients has found that, unfortunately, confusion surrounding HIPAA persists and often means that patients don’t get the kind of access to their health care information they need. We are hopeful that the clarifications HHS issued yesterday will help both providers and patients better understand the law and the opportunities it presents. When all patients can get and use their health data electronically, they will be able to more fully engage in their health and care,” said Christine Bechtel, campaign coordinator and advisor to the National Partnership for Women & Families.

Bechtel applauded the new guidance for noting that entities should leverage technology to respond to requests for records as soon as possible, and ideally sooner than the 30-day “outer limit” established by the law, and for confirming that patients cannot be required to pick up their records in person.

As part of its efforts to advance patients’ and families’ access to and use of their electronic health information, the GetMyHealthData Campaign has been collecting Tracer stories about individuals’ experiences requesting their health data. The anecdotes illustrate some common challenges related to the kind of information patients can get, how and when they can get it, and at what cost. Many of these challenges are addressed in HHS’ new guidance, including:

• How patients may request their records, making clear that providers cannot require patients’ physical presence or the use of regular mail.
• If a patient requests a particular electronic format (e.g., a machine-readable format such as a CCDA or PDF), electronic copies must be provided as long as the health care provider is able to readily produce a copy in that format. HHS is clear that the form and format of the records request is a question of provider capability (rather than willingness).
• The scope of the information patients can obtain, per the “designated record set,” includes medical records; billing and payment records; insurance information; clinical laboratory test results (including genomic information generated by a clinical laboratory); wellness and disease management program files; and clinical case notes.
• The time requirement for patients to receive their records is still 30 calendar days but HHS clarifies that with modern electronic health systems, turnaround time could be shorter and encourages providers to treat the 30-day mark as an “outer limit.”

The guidance addresses other important issues, such as when providers may deny access, the process for transmitting a patient’s record to a different person (such as a family caregiver), and the interaction between the HIPAA right of access and patient online access requirements per the Electronic Health Record “Meaningful Use” Incentive Program.

“HHS’ guidance is helpful for health information management professionals who have long been committed to ensuring that patients can get their data in a timely manner,” said AHIMA CEO Lynne Thomas Gordon, MBA, RHIA, CAE, FACHE, FAHIMA. “We’re enthusiastic about sharing these new resources with our members, many of whom serve as liaisons between patients and health care providers, to improve the availability of health information across the health care landscape. We hope that the next guidance from HHS will clarify permissible fees and encourage providers to offer the first copy of health information to the patient at minimal or no charge.” AHIMA is a co-founder of the GetMyHealthData Campaign.

“We look forward to the next clarification from HHS, later this year, particularly on the appropriate fees patients can be charged for accessing their data,” Bechtel added. “Our Tracer patients tell us this is a major hurdle, and we hope HHS will encourage entities to offer electronic health information at no charge as a best practice. After all, in this day and age, health data is absolutely essential to safe, efficient, high quality care.”

In 2015, the GetMyHealthData Campaign, AHIMA, Flip the Clinic and the Alliance for Nursing Informatics developed a fact sheet to help providers understand patients’ rights to electronic access under HIPAA, available here.

To learn more about the campaign and how to be successful in requesting data – including what to request, patients’ rights, and resources for providers – visit www.GetMyHealthData.org.