Provider Resources

Everyone has had that moment after leaving an appointment or hospital stay when you realize that you can’t remember an instruction or a medication name. Without an easy way to get ahold of your health record, you’re stuck with calling the clinic for clarification. But when health records are available—and patients are aware that they can get access—patients are given the opportunity to become more informed, proactive, and engaged in everyday health, planning, and health decision-making down the road.

– Aneesh Chopra
Former US Chief Technology Officer

Want to know more about patients’ rights to their electronic records? We can help. Here are some essential memos, guidance, and facts sheets that clarify your responsibilities and best practices when it comes to sharing electronic records with patients:

Am I really required to provide an electronic copy of a patient’s medical record?

A: Pretty much. Patients have a legal right to an electronic copy of their records under HIPAA, if those records are kept electronically. See this memo from the US Department of Health & Human Services explaining patient right to access.

You can provide electronic copies in several ways:

Email your file directly to a patient’s app. Learn about Blue Button by watching this video. You can also email records directly to patients if they request it (see below for more information). The format of the file you create from your EHR should be structured data such as a .CCDA or .CCR so that patients can combine and use their health information with other types of software. For more information on getting a secure Direct address you can use to email patients, read this article.
Download a file from your EHR system and place it on portable media, such as USB driveThe format should be structured data such as a .CCDA or .CCR so that patients can combine and use their health information with other types of software.
Patient Portals
Patient portals often give patients the ability to download and transmit their health information. If you’re participating in the federal “Meaningful Use” program, your portal should be capable of these features. Ask your vendor for more information. Be aware that this option does not provide the entire medical record, so talk with patients about what they would like and let them know they can look at what’s available on your portal as a starting point.
Blue Button
An increasing number of health providers, pharmacies and insurers are adding a blue (download) button to their websites to help consumers get their health information electronically. The information that is available depends upon the source (i.e., health insurance company, drug store, laboratory). Currently, all Medicare beneficiaries, service members, and Veterans can go online and download their health data with the click of the Blue Button. Blue Button is not yet available to everyone, but it is rapidly growing. To learn more about Blue Button, visit this page on the website

A patient asked us to email their records to them, but I’m worried about security. What do I do?

A: The federal government clarified in guidance that patients may choose to receive copies of their medical records by unsecure e-mail. You should let patients know that there is a risk that the e-mail may be intercepted and the contents – including the medical records – accessed by an unauthorized person. Patients can choose to accept that risk for the convenience of having records sent by e-mail. For more information, read this document.

Can I require the patient to either request or pick up their electronic records in person?

A: You can require that the patient verify their identity including through means such as answering questions over the phone (confirming their address, etc.). But verification does not need to be done in person. And don’t forget that if you are participating in the federal Electronic Health Record Incentive Program (aka: Meaningful Use EHR program), then you need to provide a means for patients to electronically download their health information. This is another option you can offer for patients to download e-copies. But if they request their full medical record electronically, they have that right under HIPAA.

What about requests for records made by people who are not the patient? (i.e., a person caring for a child, spouse, elderly parent).

A: A patient can request that you send a copy of their records to someone else. The US Department of Health & Human Services issued this memo explaining patient right to access.

Generally, a provider must allow a personal representative the patient designates to inspect and receive a copy of protected health information. A personal representative is someone who by law is authorized to act on an individual’s behalf and can be named several ways; state law may affect how a person becomes a personal representative. For more information on personal representatives, read this article.

Finally, this webpage from the federal Office of Civil Rights has answers to many more questions about disclosures to friends and family on this page.

Can I charge for providing electronic copies?

A: Recent guidance from the federal government encourages providers to offer patients electronic copies of their health information free of charge. The policy further clarifies when and how patients can be charged fees for their health data, including:

  • No charging for patient portal access through certified EHRs;
  • No per-page fees for electronic copies; and
  • No surprise fees; you must inform the patient in advance of the approximate fee that may be charged.

The law allows you to charge for the reasonable costs for copying and mailing the records, but mostly that applies to paper records. When it comes to electronic copies, providers can charge for the cost of providing the electronic information on a CD-ROM or USB drive. You cannot charge a fee for searching for or retrieving records. Fees for copying and mailing records may vary by state.

I gave a patient their record, and they identified mistakes or missing information they want to correct.

A: Patients can ask to change any incorrect information in their record or add information to their record. Even if you, the provider, don’t agree with the requested changes, patients still have the right to have the disagreement noted in their record. See this website outlining patients’ rights to request a change to their record.

Why share access to electronic records?

A: Research shows that the more patients access and use their electronic health information, the more they are satisfied with their care and trusting of their providers. Even more importantly, the more patients use their electronic health information, the more knowledgeable and motivated they are to improve their health. It’s a win-win! To learn more, read this article.