HCS/430 Week 3: Privacy, Consent and Medical Records, sample paper

Seventy-Four Days and $185 for Her Own Chart: A HIPAA Right of Access Complaint Against an Orthopedic Practice and the Records Process That Replaced the Old One

[Student Name]

University of Phoenix

HCS/430: Legal Issues in Health Care: Regulation and Compliance

Week 3 Assignment

[Instructor Name]

[Date]

The practice, patient and events are a composite written for a model paper.

A composite 52-year-old woman who had been treated for a torn rotator cuff by a 14-physician orthopedic practice wanted a second opinion before agreeing to surgery. She asked the practice for a copy of her records, including the MRI images and report, office notes and therapy notes, in electronic form. The front desk told her to fill out an authorization form, have it notarized and wait. After 74 days and three calls, she received a paper copy by mail, without the MRI images, and a bill for $185, calculated at a per-page rate. She filed a complaint with the federal Office for Civil Rights, and the practice learned that nearly every step of its process was wrong. This paper analyzes the complaint under the law and describes the practice's corrective plan.

The Right of Access

The HIPAA Privacy Rule gives individuals a legal right to see and obtain copies of their protected health information held in a designated record set, which includes medical and billing records used to make decisions about them (Pozgar, 2023). The rule, codified as Access of Individuals to Protected Health Information, sets requirements for how quickly covered entities must respond, the form in which they must provide records and what they may charge. The Office for Civil Rights in the Department of Health and Human Services enforces it, and since 2019 it has pursued a series of enforcement actions focused on right of access failures, many against small practices.

Compliance with the access rule has been uneven. Lye et al. (2018), who contacted 83 top-ranked U.S. hospitals, found frequent inconsistencies between the information on hospitals' request forms and what staff said by telephone, and many hospitals did not offer all the formats patients could legally request or quoted fees above federal guidance.

Testing the Practice's Response Against the Rule

Timing

A covered entity must act on an access request within 30 calendar days of receiving it. It may extend that once, by up to 30 days, provided that, before the first deadline passes, it tells the patient in writing why more time is needed and when to expect the records. The practice took 74 days without notice of any extension, a clear violation. Many states set shorter deadlines, and the stricter law applies.

Conditions on the request

A covered entity may require requests in writing, but it may not impose unreasonable barriers. Requiring notarization, or requiring patients to use an authorization form designed for disclosures to third parties, delays access without a legal basis. A patient requesting her own records is exercising a right of access; she does not need to authorize disclosure to herself.

Form and format

If a patient requests an electronic copy of records maintained electronically, the covered entity must supply the electronic format she asked for whenever it can readily produce that format, and otherwise an electronic format the two of them agree on. The practice's records, including MRI images stored in its imaging system, were electronic and could have been provided through the patient portal, by secure email if she accepted the risk, or on a disc. Mailing paper without the images failed this requirement.

Fees

What the rule permits is a charge limited to actual costs: staff time spent making the copy, the disc or paper it goes on and mailing, if the patient wants it mailed. Fees for searching and retrieving records are not allowed. A per-page fee is generally inappropriate for electronic records, and the government has described a flat fee of $6.50 as an option for electronic copies of electronic records. A $185 bill for a paper copy she did not ask for was not a reasonable, cost-based fee.

The Consent Questions

Two related questions came up during the investigation. First, the patient's adult son had called to ask about the delay, and a staff member refused to discuss anything with him. That was correct unless the patient had identified him as someone involved in her care or he was her personal representative with legal authority to act for her; an adult child has no automatic right to a parent's records.

Second, the patient had asked that the records be sent directly to the second-opinion surgeon. HIPAA permits a covered entity to disclose information to another provider for treatment without a written authorization, so the practice could have sent the records to the surgeon immediately. Alternatively, a patient may direct that her own records be sent to a third party she designates, which must be in writing and clearly identify the recipient.

The Organization's Exposure

The complaint exposed the practice to an Office for Civil Rights investigation, which could end with technical assistance, a resolution agreement with a corrective action plan and monitoring or a civil monetary penalty. Because the practice cooperated and corrected its process quickly, the most likely outcome was technical assistance and a corrective plan. The practice also faced reputational harm and the risk of state enforcement.

The Corrective Plan

The practice took five steps. First, it separated its forms: a simple access request form for patients seeking their own records and a separate authorization form for disclosures to others. Notarization was dropped. Second, it designated a trained release of information specialist and set an internal target of ten business days, with a tracking log that flags any request older than 20 days. Third, it enabled full portal access to office notes and results, and it created a process for providing imaging on disc or through a secure image-sharing link. Fourth, it adopted the flat fee of $6.50 for electronic copies and a written cost-based fee schedule for paper copies. Fifth, it trained front desk staff on the difference between access, treatment disclosures and third-party authorizations, with a one-page guide at each workstation.

The patient received her complete electronic record, including images, within two days of the practice's review, with a refund of the $185.

Conclusion

A patient's request for her own records exposed a process built on mistaken assumptions: that she needed a notarized authorization, that paper was acceptable and that a per-page fee was allowed. The HIPAA right of access sets clear rules on timing, format and fees, and the Office for Civil Rights has made enforcement a priority. Redesigning the process around the patient's right, not the practice's convenience, brought the practice into compliance and gave patients what the law intends: timely, affordable access to their own health information.

References

Access of Individuals to Protected Health Information, 45 C.F.R. § 164.524 (2024).

Lye, C. T., Forman, H. P., Gao, R., Daniel, J. G., Hsiao, A. L., Mann, M. K., deBronkart, D., Campos, H. O., & Krumholz, H. M. (2018). Assessment of US hospital compliance with regulations for patients' requests for medical records. JAMA Network Open, 1(6), Article e183014. https://doi.org/10.1001/jamanetworkopen.2018.3014

Pozgar, G. D. (2023). Legal aspects of health care administration (14th ed.). Jones & Bartlett Learning.