HIPAA Records Release Rules

The federal Health Insurance Portability and Accountability Act (HIPAA) instituted by Congress in 2003 provides a standard for the treatment of patients’ medical records. It prescribes a set of privacy protections afforded to patients’ health information maintained by health providers, insurance plans and health clearinghouses that retain and distribute electronic copies of medical records. Among these protections are rules for the release of patient records.

Under HIPAA, patients have the right to request copies of their medical records with some exception. A patient cannot request and expect to receive information such as notes from a psychotherapy session or information gathered for a legal case. In addition, a facility has the authority to deny a patient access to his medical records when the release of information can harm him or someone else.

The medical information of a deceased family member can sometimes be relevant in the treatment of another family member. To accommodate this situation, HIPAA offers surviving family members two ways to seek this information. First, health information of a decedent is available without authorization to the health care provider treating the surviving family member. Second, a legally authorized representative acting on behalf of the deceased has the power under the federal HIPAA law to request the medical records and receive it on the deceased's behalf.

Health providers, insurance plans and clearinghouses that fall under the rules of HIPAA must provide patients the ability to access their medical records. HIPAA stipulates that these health care organizations must give patients instructions for their respective processes for record release. For example, if a health provider requires a patient provide a written request, then the provider is obligated to explain this to the patient.

HIPAA states that a health care organization can levy a reasonable fee for the costs associated with copying a patient’s medical records. However, the organization cannot charge a patient for the time spent locating their records.

A health care organization has 30 days under HIPAA to release a patient’s medical records. When an organization cannot meet this deadline, it can request a 30-day extension with good reason (i.e., natural disaster).

According to Private Rights Clearing House, one common misconception of HIPAA is that it protects a patient’s medical information from being shared without consent. However, it only offers limited protection that extends just to health providers, insurance companies and certain health clearinghouses. Even then, a physician does not need a patient’s consent to share a patient’s medical records for billing, treatment or health care operations (i.e., to track patient health status).