Have you ever called your dentist's office to ask for your dental records to be sent to a new office? Perhaps you’re moving, seeing a specialist, switching providers, or just curious about your information. What are your rights when it comes to accessing and sending your personal health information (PHI)?
Remember all that paperwork that nice person at the front desk gives you? One of those sheets is the Health Insurance Portability and Accountability Act Notice of Privacy Practices for the office, or HIPAA notice. HIPAA is a federal law that created standards to protect sensitive health information from being disclosed without your consent or knowledge. That act spells out patients’ rights to their PHI and regulates how offices provide it.
Request for access
Your dental office may require you to request your records in writing on a form provided by them or simply your own written request. That document needs to be signed by the individual, a legal caregiver, or the individual’s representative (generally someone with a power of attorney on file). However, the office can’t require a patient to do this in person, via the office records portal, or the mail—meaning the request can be scanned and emailed or faxed. This allows for timely access to records and no burdensome barriers like not understanding a portal.
You have a right to request hard copy or digital records. If requested digitally, it must be “readily producible,” meaning you have a way to open it. They can also be put on a thumb drive and mailed.
Cost and patient payment obligations
Under HIPAA, the provider is prohibited from charging an individual more than a reasonable, cost-based fee that covers only the cost of labor to make the copies, supplies, and postage. This applies whether it is sent to the individual or to a third party.
The general rule of thumb is an office can charge for supplies like paper, thumb drives, envelopes, postage, etc. They can also charge for the labor associated with copying, scanning, mailing, etc.
They can’t charge for the time it takes to review the request for access, nor can they charge for the time searching for, collecting, and compiling the records. They also can’t offset the cost of the electronic health record portal in the name of information access. The fees can only be for actual costs of copying and mailing (and can’t be per page).
Whatever fee an office decides on, they must provide an estimate prior to fulfilling the request. They must also provide a breakdown of fees if so requested. Offices can charge a flat fee of $6.50 inclusive of labor, supplies, and postage if they prefer.
Some states require health-care providers to give individuals one free copy of their medical records. In those cases, HIPAA law does not override state law; whichever law provides greater access to PHI will prevail.
HIPAA expert Sarah Stream, MPH, CDIPC, CDA, and CEO of Stream Education and Consulting, provided some clarity on the issue of patient payment obligation and rights.
“Regardless of the fee if there is one, the office cannot hold your records from you if you do not pay. You, as a patient, have rights to your records regardless of the cost of a records release fee,” says Stream. “If an office refuses to give you access to your records for any reason, you have the right to submit a complaint directly to the U.S. Department of Health and Human Services through the Health Information Privacy branch.”
Who can access your records?
“The HIPAA Security Rule allows for the transmission of health records between covered entities to promote continuous care,” notes Stream. “This means that another medical provider that is covered under HIPAA laws (your new dentist, a pharmacy, a specialist, or your primary care provider) can request your records to be transferred to their office for your care without your permission.
Your office cannot, however, release records to any other entity or person without your permission,” she adds. “If you want to release records to someone besides you or another healthcare entity that is not involved in your care, you would need to work with them on an official records release.”
Time frame for record release
Providing access to your records must happen no later than 30 days from receiving the request. HIPAA stresses that this is the outer limit of the time frame, and offices are encouraged to respond as soon as possible. If an office is unable to provide the records within 30 days—perhaps the file is stored offsite and not readily available, for example—the office can extend the time another 30 days and inform the individual, in writing, of the reasons for the delay and the date they will be provided. Only one extension is permitted.
The long and short of all these rules is that you, as the patient, not only have access to your health records; you also have a right to them. And it shouldn’t be difficult to get them from your provider. While all offices are required to have HIPAA training, they also get confused by all the rules. Although it may be frustrating, be patient with the rules they’re required to follow; ultimately they’re for your protection.
Amanda Hill, BSDH, RDH, describes her career in dental hygiene as an adventure. Growing up and marrying into the military, she experienced dentistry throughout the world. She is a speaker, consultant, and award-winning author. A member of the advisory board for RDH magazine, frequent author on DentistryIQ, and the recipient of OSAP’s Emerging Infection Leader award, Hill strives to make topics in dentistry accurate, accessible, and fun. You can reach her at [email protected].
