Under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, a patient has a right to request a copy of protected health information (PHI) from an urgent care provider that qualifies as a covered entity and provides medical care to the patient. The urgent care provider may also provide an explanation or summary of PHI, upon agreement of the patient. The urgent care provider may charge the patient a fee for copying the PHI. However, the fee must be both reasonable and cost based. The fee may include costs for the following (i) staff labor for paper or electronic copying or to prepare an explanation or summary of the patient's PHI upon request; (ii) office supplies and media devices for creating the paper or electronic copies; and (iii) postage for the delivery of copies and summaries. HIPAA does not allow an urgent care provider to charge a standard search or retrieval fee for the provision of paper or electronic copies of PHI to a patient, even if such fee covers actual retrieval costs. These limitations may create a conflict with state law and may trip up an unwitting urgent care provider who believes in good faith that it is charging a patient appropriately.

An urgent care provider must follow state law when setting copy fees. However under HIPAA's preemption rules, if HIPAA is stricter than state law, i.e., more protective of a patient's privacy rights, then HIPAA controls. Many states set limitations on standard fees, labor costs and reasonable per-page fees that an urgent care provider may charge a patient for providing the patient with a copy of his or her medical records. These standard fees sometimes include a provision for a search and retrieval fee, but under HIPAA an urgent care provider may not charge a search or retrieval fee to a patient. Thus, any such fee should be removed from an invoice or other statement provided to a patient in connection with the fulfillment of an access request and should not be collected from a patient at an urgent care provider site. Similarly, the Department of Health and Human Services (HHS) utilizes state law limits to define a reasonable fee under HIPAA, but under HIPAA an urgent care provider must charge a fee that is also cost based, thereby limiting the total allowable charge.

HHS interprets labor costs to include time spent by skilled technical staff to create and distribute electronic PHI files through compilation, extraction, scanning and the burning of PHI to media devices. Media devices include CDs and USB flash drives. Urgent care providers are not required to invest in new technologies or maintain data storage infrastructure just to comply with a patient's request. Thus, urgent care providers must not pass on the costs of any new technology or data storage infrastructure to their patients.

The following illustrates the application of HIPAA's limitation on fees that may be charged to a patient in connection with the fulfillment of the patient's access request: An urgent care provider is located in State A, which imposes a search fee of $10, a ten cent-per-page fee limitation and a labor fee up to $20 for paper and electronic copies of medical records. A patient walks into the urgent care provider site, undergoes an evaluation by a physician and then requests electronic and paper copies of her PHI from that visit without the intent to maintain an ongoing patient relationship.

  1. The urgent care provider should not charge the patient a search fee of $10, allowed by State A, as HIPAA prohibits the urgent care provider from charging a standard search or retrieval fee for the provision of a patient's PHI.
  2. All page rates charged by the urgent care provider in State A from one to ten cents per page would be reasonable under HIPAA, and any rate over ten cents per page would be unreasonable. However, a copy fee must also be cost based. Thus, if the cost of copying PHI by the urgent care provider in State A is five cents per page, and yet the urgent care provider charges ten cents per page in accordance with the limits of the law of State A, it will run afoul of HIPAA. While both rates are reasonable, the urgent care provider may charge up to only five cents per page because it can recover only the actual cost of providing such copies.
  3. State A's $20 limitation on the labor fee will be the ceiling for what HHS considers reasonable (i.e., if labor costs exceed the $20 limitation, only $20 may be charged). However, under HIPAA the urgent care provider may charge only an amount, up to the State A limit of $20, that reflects the actual labor costs to the urgent care provider for the copying of the medical records and time spent by skilled technical staff to create and distribute electronic PHI files through compilation, extraction, scanning and the burning of PHI to media devices such as CDs and USB flash drives. Finally, the labor costs must also not take into account any time spent on searching for or the retrieval of the medical records.

Originally published by Urgent Care Association of America.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.