Hospitals Continue to Fail to Provide Patients with Copies of Medical Records


Under the HIPAA Privacy Rule, patients have the right to get a copy of their health records from healthcare providers. When requested, copies of health records must be given as quickly as possible or within 30 days from the day of submitting the request.

This particular HIPAA Privacy Rule has been in effect since April 14, 2003. However, many hospitals still fail to give patients their copies of health records. In 2011, Cignet Health of Prince George’s County had to pay the Department of Health and Human Services’ Office for Civil Rights (OCR) the amount of $4,300,000 civil monetary penalty because of non-compliance to this rule.

JAMA Network Open published a new study showing that many healthcare providers are not complying to the above rule:

  • They do not provide patients copies of their complete medical records
  • They are asking for excessive amounts in exchange for the copies of medical records
  • Some hospitals are making it difficult for patients to know about their right to have a copy of their medical records and exercise that right

Yale University School of Medicine researchers conducted the study. They assessed 83 hospitals in the U.S. in terms of the processes they follow for issuing copies of medical records to patients. Only 53% of the hospitals are able to give patients their complete medical records.

HIPAA demands that patients be given copies of their health records in the format they choose. Yet a lot of hospitals do not comply with this requirement. Moreover, discrepancies were seen between information given over the telephone and those indicated on the release forms. For instance, the information provided over the telephone state that 83% of hospitals said the patients’ copies of medical records can be acquired in person, yet just 48% mentioned this on the release forms. Over the phone, 66% said electronic health records may be given on a CD, but on 25% of forms this format is only an option.

In 2016, OCR made clear that patients have the right to access their medical records and limited the fees healthcare providers can charge patients for copies of their health records. For electronic medical records, the recommended fees is no more than $6.50. However, the study showed that 48 out of 83 hospitals charged more than this recommended amount. One hospital even billed a patient $541.50 for a medical record that is 200 pages long.

43% of hospitals didn’t indicate on the request forms what amount patients are billed for exercising their right to acquire a copy of their health records and just 35% of hospitals revealed precise fees on the release form or on the website page where patients can download the form.

Seven hospitals (8%) do not comply with the 30-day processing time. Each of the seven hospitals give patients their medical records after the 30-day maximum.

In addition, healthcare providers do not give complete and accurate information on the forms. Many patients had to call the medical records section to determine the full details for releasing their medical records. A number of hospitals do not give paper and electronic copies of medical records. The process for releasing medical records among the 83 hospitals were inconsistent.

The researchers conclude that US hospitals lack a uniform procedure for requesting copies of medical records, which highlights the problem of healthcare providers in complying with the patients’ right of access under HIPAA. In order to have a healthcare system that prioritizes patients, there must be an agency having control over their own data.