​In response to several questions received after the U.S. Department of Health and Human Services (HHS) Office of Civil Rights (OCR) published a fact sheet in early 2016 on individuals’ rights to access protected health information (PHI) under the Health Information Portability and Accountability Act (HIPAA), OCR updated its guidance May 24. Apparently, there was confusion about the $6.50 flat fee charge for electronic copies of PHI presented in the Fact Sheet.

In the Fact Sheet, OCR announced that under the right of access provisions, a flat fee not to exceed $6.50 is a permissible option for covered entities when charging individuals requesting an electronic copy of PHI. Evidently, some organizations assumed $6.50 was the maximum amount they could charge for all individual requests for an electronic copy.

In the update this week, OCR clarified the $6.50 flat fee is not a maximum, but is an option available to covered entities that do not want to go through detailed cost calculations under HIPAA’s Privacy Rule, which also were identified in the Fact Sheet. When a covered entity charges the flat fee for electronic copies of PHI, avoiding the calculations and schedules required when charging its actual or average costs, the flat fee charged must not exceed $6.50, inclusive of all labor, supplies and postage.

OCR provides guidance for each of the three methods covered entities may use to calculate what OCR deems reasonable, cost-based fees under the HIPAA Privacy Rule. It is important that providers review all guidance from OCR related to charges allowed when responding to PHI copy requests (or requests for a summary or explanation of the PHI, if applicable) from individuals.

In addition, providers should always be aware of specific state laws that contain fee schedules of charges allowed related to PHI requests -- HIPAA does not preempt state laws that provide greater protection, or broader patient rights. Certain states’ laws require health care providers to give individuals one free copy of the entire medical record, and since those state laws grant a greater right access to PHI to individuals than the HIPAA Privacy Rule does, they will control.  On the other hand, any charges for PHI authorized by state law, but deemed unreasonable by the HIPAA Privacy Rule, would not be allowed.

For additional guidance from OCR on the rights of access under the HIPAA Privacy Rule, including the updated FAQs clarifying the $6.50 flat fee charge, see: http://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html#newlyreleasedfaqs