HIPAA is often described as dealing with CIA – the Confidentiality, Integrity and Access to patient records. In the past, access to patient records often required a written request, accompanied by a response in the mail that could take several weeks. However, in today’s world where electronic systems can provide almost instant action to data, patients expect requests to be fulfilled in a much more timely manner.
The HIPAA regulations are behind the times on this. Here is a link to what is required: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html. In this description of an Individuals Right to access their Health Information, we have this regarding timeliness:
In providing access to the individual, a covered entity must provide access to the PHI requested, in whole, or in part (if certain access may be denied as explained below), no later than 30 calendar days from receiving the individual’s request. See 45 CFR 164.524(b)(2). The 30 calendar days is an outer limit and covered entities are encouraged to respond as soon as possible. Indeed, a covered entity may have the capacity to provide individuals with almost instantaneous or very prompt electronic access to the PHI requested through personal health records, web portals, or similar electronic means. Further, individuals may reasonably expect a covered entity to be able to respond in a much faster timeframe when the covered entity is using health information technology in its day to day operations.
So technically the requirement is only 30 days! But organizations are encourage to respond much quicker. At some point in the future, there will be a rewrite of this part of HIPAA, no doubt. However, recognizing that this is a problem, CMS developed a measure in Meaningful Use to require organizations to respond to patient requests for electronic access to records in a more timely manner:
For Providers, 4 days: https://www.cms.gov/Regulations-and-Guidance/Legislation/EHRIncentivePrograms/Downloads/2016EP_8PatientElectronicAccessObjective.pdf
For Hospitals, 3 days: https://www.cms.gov/Regulations-and-Guidance/Legislation/EHRIncentivePrograms/Downloads/2016EH_8PatientElectronicAccessObjective.pdf
So all that is necessary to meet the Meaningful Use requirements and collect incentives, is to run the reports and make sure that the numbers are accurate – right? Not so fast. Some Indiana lawyers, whose day-to-day work requires them to make requests for medical records became frustrated when it took a long time to receive records. So what did they do? They filed a lawsuit!
Here are the details: https://www.careersinfosecurity.com/lawsuit-hospitals-lied-about-providing-quick-records-access-a-10485
The lawsuit claims, among other things, that the hospitals repeatedly were tardy in responding to requests for patient records and that they had accepted Meaningful Use dollars in which they claimed they responded to requests within 3 days. The lawsuit seeks $1 billion in damages and notes that the hospitals collected $324 million in MU incentive payments. CMS independently audits providers and hospitals on their MU attestations. However, what we have learned from this lawsuit is that outside parties may jeopardize Meaningful Use dollars if they feel that organizations are not meeting their MU obligations in fact.
The US has a fragmented healthcare system. One of the goals of Meaningful Use and the implementation of near universal Electronic Health Records was to give patients quick and convenient access to their own records so each person can more easily assist in their own coordination of care. Few people would disagree that this is a worthwhile cause. Making records available on a timely basis is good for your patients and good for your practice. Is your medical records department responding to requests in a timely manner? It might be wothwhile to double check.
Leave a Reply