DRAFT
Version 3/FINAL: 4/17/15
Based on Final HIPAA Security Rule & HITECH Interim Rules (8/24/09)
______________________________________________________________________________
HIPAA COW
PRIVACY AND SECURITY NETWORKING GROUPS
CHARGING FOR COPIES AND SUMMARIES OF PROTECTED HEALTH
INFORMATION
Disclaimer
This document is Copyright  by the HIPAA Collaborative of Wisconsin (“HIPAA COW”). It
may be freely redistributed in its entirety provided that this copyright notice is not removed.
When information from this document is used, HIPAA COW shall be referenced as a resource.
It may not be sold for profit or used in commercial documents without the written permission of
the copyright holder. This document is provided “as is” without any express or implied
warranty. This document is for educational purposes only and does not constitute legal advice.
If you require legal advice, you should consult with an attorney. Unless otherwise noted,
HIPAA COW has not addressed all state pre-emption issues related to this document.
Therefore, this document may need to be modified in order to comply with Wisconsin/State law.
State Preemption Issues: Wisconsin Statues impact charges for copies and summaries of PHI.
See reference grid embedded in this policy for further (but limited) information. Wis. Stat. §
146.83 language has been interfaced with HIPAA in this policy. Follow HIPAA regarding the
fee allowable to be charged to patients for copies of their records. HIPAA allows charging the
patient a “cost based fee.” HIPAA is silent on charging others for copies and state law allowing
a “reasonable” fee may be applied.
Note: Pursuant to Wis. Stat. § 146.83 (3f) (c) 2., each July 1, beginning on July 1, 2012, the
Department of Health Services is required to adjust, by the percentage difference between the
consumer price index for the 12−month period ending on December 31 of the preceding year
and the consumer price index for the 12−month period ending on December 31 of the year
before the preceding year, the dollar amounts specified under Wis. Stat. § 146.83(3f) (b) that a
health care provider may charge for providing copies of a patient’s health care records.
Purpose: To provide guidance with regard to charging for copies and summaries of patient
protected health information (PHI)
Background:
The Health Insurance Portability & Accountability Act (HIPAA) Privacy Rule permits a
healthcare provider to impose reasonable, cost-based fees for responding to requests made by an
individual (patient or legal representative) for copies of patient health records. HIPAA limits the
types of costs that may be imposed for providing copies of patient health records. Additionally,
the inclusion of a copying fee is not intended to impede the ability of individuals to obtain copies
of their PHI. If the patient has agreed to receive a summary or explanation of his or her health
______________________________________________________________________________
 Copyright HIPAA COW
1
information, the healthcare provider may also charge a fee for preparation of the summary or
explanation. The fee may not include cost associated with searching for and retrieving the
requested information. State statutes also provide regulations addressing charges for different
types of health record copy requests made by an individual (patient or legal representatives) or
other third parties. State statutes may conflict with HIPAA regulations, so it is necessary to be
aware of both HIPAA and state regulations to determine where state regulation may preempt the
HIPAA regulation.
The HIPAA Omnibus Rule, 164.524 of Title 45, Code of Federal Regulations. “Access of
Individual to Protected Health Information” in 164.524(c)(2) states Form of access requested. (i)
The covered entity must provide the individual with access to the protected health information in
the form and format requested by the individual, if it is readily producible in such form and
format; or, if not, in a readable hard copy form or such other form and format as agreed to by the
covered entity and the individual. (ii) Notwithstanding paragraph (c)(2)(i) of this section, if the
protected health information that is the subject of a request for access is maintained in one or
more designated record sets electronically and if the individual requests an electronic copy of
such information, the covered entity must provide the individual with access to the protected
health information in the electronic form and format requested by the individual, if it is readily
producible in such form and format; or, if not, in a readable electronic form and format as agreed
to by the covered entity and the individual. (iii) The covered entity may provide the individual
with a summary of the protected health information requested, in lieu of providing access to the
protected health information or may provide an explanation of the protected health information
to which access has been provided, if: (A) The individual agrees in advance to such a summary
or explanation; and (B) The individual agrees in advance to the fees imposed, if any, by the
covered entity for such summary or explanation.
The covered entity may impose fees as stated in 164.524(c)(4):
Fees. If the individual requests a copy of the protected health information or agrees to a
summary or explanation of such information, the covered entity may impose a reasonable, costbased fee, provided that the fee includes only the cost of:
(i) Labor for copying the protected health information requested by the individual, whether in
paper or electronic form; (ii) Supplies for creating the paper copy or electronic media if the
individual requests that the electronic copy be provided on portable media; (iii) Postage, when
the individual has requested the copy, or the summary or explanation, be mailed; and (iv)
Preparing an explanation or summary of the protected health information, if agreed to by the
individual as required by paragraph (c)(2)(iii) of this section.
Policy Statements:
General Statements Covering Individual/Patient Requests:

If an individual requests a copy of PHI, a covered entity may charge a reasonable, cost –
based fee for the copying, including the labor and supply costs of copying.
 If hard copies are made, this would include the cost of paper.
 If electronic copies are made to a computer disk, this would include the cost of the
computer disk.
______________________________________________________________________________
 Copyright HIPAA COW
2




Covered entities may not charge any fees for retrieving or handling the information or for
processing the request.
If an individual requests that the information be mailed, the fee may include the cost of
postage.
If an individual requests an explanation or summary of the information provided, and
agrees in advance to any associated fees, the covered entity may charge for preparing the
explanation or summary.
If an individual requests an “accounting of disclosures” to identify what PHI has been
disclosed to others, the organization must provide the first accounting free in any 12month period. Subsequent requests in the 12-month period can be charged a reasonable
fee based on the organization’s costs of providing an accounting. Before charging the
fee, the organization must inform the patient and allow them the opportunity to withdraw
or modify the request to avoid or reduce the fee.
General Statements Covering Provider Requests:

As a courtesy, health care providers may waive copy charges for the disclosure of PHI
between providers. This practice is at the discretion of the provider.
State Specific Laws & Regulations Impacting Fees for Copies and Summaries of PHI:
Note: Federal and Wisconsin laws refer to “individuals,” “persons,” and “patients.” Based on
the regulatory reference, terms are used interchangeably in the attachment. “Patient
Representative” refers to that individual authorized by the patient or the patient’s legal
representative.
In general, the authority of a personal representative under the Privacy Rule to act on behalf of
an individual stems from the representative's authority to make healthcare decisions for that
individual. Furthermore, the Preamble clarified that the intent of HHS was to enable individuals'
access to their PHI (protected health information). "We do not intend to affect the fees that
covered entities charge for providing protected health information to anyone other than the
individual." 65 Fed. Reg. 82462, 82557 (Dec. 28, 2000), see also 67 Fed. Reg. 53182, 53254
(Aug. 14, 2002).
Accordingly, third-party requests for medical records, including attorneys’ requests, continue to
be subject to fees established under state law. A request from an attorney qualifies for the
“HIPAA rate” rather than the state-authorized fee only if the attorney qualifies as the individual’s
“personal representative” under HIPAA, meaning that the attorney has authority to act on behalf
of the patient with respect to making decisions related to health care (i.e., treatment decisions).
See 45 CFR § 164.502(g). HHS has clarified that “an attorney of an individual may or may not
be a personal representative under the rule depending on the attorney’s authority to act on behalf
of the individual in decisions related to health care.” 65 Fed. Reg. 82,651 (Dec. 28, 2000). The
mere fact that an attorney represents an individual in litigation does not mean that the attorney
has authority to act on behalf of the individual in decisions related to health care. “78 Fed. Reg.
5606 (Jan. 25, 2013)”.
______________________________________________________________________________
 Copyright HIPAA COW
3
Requests in the form of subpoenas or from third parties and their attorneys appear to fall outside
of the HIPAA-imposed fee limitations/timeframe and remain subject to applicable state laws.
The retrieval charges and certification charges apply as outlined in Wis. Stat. 146.83. In
addition, the statute is silent as to the timeframe when records are to be provided for purposes
other than the individual’s access to PHI.
Wisconsin – Updated July 1, 2014*
Paper Copies of Health
Records
(See Exception for Medicaid
Patients Below)
$20.96 Processing and Handling Fee (Cannot
be Charged to Patient or Person Authorized
by Patient)
$1.06 per Page for the First 25 pages; $0.78
per Page for Pages 26-50; $0.53 per Page for
Pages 51-100; and $0.31 per Page for Pages
101 and Above
Wis. Stat. §
146.83(3f)
Wis. Stat. § 51.30
45 CFR §
164.524(c)(4)
Actual Postage/Shipping Costs and Applicable
Taxes
Paper Copies of Health
Records – Medical
Assistance Patients
Microfiche or Microfilm
Copies of Health Records
Copies of Health Records –
Certified
Prints or Copies of X-Ray
Examinations/Images
Copies of Health Records –
STAT Requests
Copies Must be Made Available to Patient/
Patient Representative Within 30 Days of
Receipt of Request
Charge of 25% of the Applicable Fee for
Providing 1st Set of Records; 100% of the
Applicable Fee for a 2nd or Additional Set
Records
$1.57 per Page
Wis. Stat. §
146.83(1f)
Wis. Stat. §
146.83(3f)
As Above with Additional $8.38 Fee for
Certification (Cannot be Charged to Patient
or Patient Representative)
$10.47 Per Image
Wis. Stat. §
146.83(3f)
Organizational Decision
WI Regulation
Removed
7/1/2011
Wis. Stat. §
146.83(3f)
Copies of Health Records to
be Received in Electronic
Format
$20.96 Processing and Handling Fee (Cannot
be Charged to Patient or Person Authorized
by Patient)
Produced from Paper
Records
$1.06 per Page for the First 25 pages; $0.78
per Page for Pages 26-50; $0.53 per Page for
Pages 51-100; and $0.31 per Page for Pages
101 and Above
Wis. Stat. §
146.83(3f)
Wis. Stat. § 51.30
45 CFR §
164.524(c)(4)
Actual Postage/Shipping Costs and Applicable
Taxes45 164.524(c)(2)
______________________________________________________________________________
 Copyright HIPAA COW
4
Wisconsin – Updated July 1, 2014*
45 CFR §
Produced from EHR
Organizations that use an EHR must provide
164.524 (c)(4)
individuals the option to receive an electronic
copy of their PHI. Any associated fee charged
by the CE can only cover its labor costs for
providing the electronic copy.
Copies and/or images produced from an EHR
for anyone other than the individual or the
individual’s legal representative may be
charged under a different structure such as
what is noted above (Wisconsin/HIPAA is
silent on this).
Copies Must be Made Available to Patient/
Patient Representative Within 30 Days of
Receipt of Request
Guidance in the Omnibus rule states “if the
state law per page fee is 25 cents, and the
covered entity can provide an electronic copy
for 5 cents per page, then the covered entity
may only charge 5 cents per page. If the
covered entity can provide an electronic copy
for 30 cents, it may only charge 25 cents per
page, as this is not reasonable based on state
law.”
Copies of Health Records for
Appealing a Denial of Social
Security Disability
Insurance
Copies of Health Records
Requested for Workers
Compensation
Inspection of Health
Records by Patient or
Person Authorized by
Patient – No Copies
No More Than Amount That the Federal
Social Security Administration Reimburses
the Department (DHS) for Copies of Patient
Health Records
Not to Exceed the Greater of $0.45 Per Page
or $7.50 Per Request, Plus the Actual Costs of
Postage.
Charges applicable to the employee,
employer, worker's compensation insurer, or
department or its representative (legal
counsel).
Must be Made Available for Inspection to the
Patient/Patient’s legal Representative Within
30 Days
No Fee May be Assessed for Inspection
45 CFR §
164.524(c)(4).
Wis. Stat. §
146.83(1f)
Wis. Stat. §
102.13(2)(b)
Wis. Stat. §
146.83
45 CFR §
164.524(b)(2)
* Wisconsin Administrative Register, No. 702 – Effective Date July 1, 2014, Page 30 –
Available at: http://docs.legis.wisconsin.gov/code/register/2014/702b/register.pdf
______________________________________________________________________________
 Copyright HIPAA COW
5
Factors That May Impact the Cost of Responding to Release of Information Requests:
Costs of providing copies of PHI may be impacted by a variety of factors. Charges may differ
depending upon the party making the request. HIPAA does allow an organization to charge a
reasonable, cost-based fee for copying PHI for the patient/legal guardian, including labor and
supply costs; however, covered entities may not charge patients/legal guardians any fees for
retrieving or handling the information or for processing the request. The following factors may
impact the charges an organization may assess for copies of PHI: 1

Labor costs involved with ensuring authorization appropriateness

Labor costs and software associated with logging of requests to a database

Labor costs involved in physically retrieving the health information

Labor costs associated with re-filing retrieved health information

Labor costs associated with the physical copying of health information

Expense costs for paper, toner, and equipment maintenance involved in copying

Capital costs associated with acquiring copying equipment

Handling expense involved in preparing a document for mailing

Postal expense for mailing

Expense associated with invoicing for copies

Bad debt "write-off" expense

"Non-billable" request expense

Real estate costs of storage space and copier work space
NOTE: Neither federal nor state law provides direction for fax delivery of health record
copies.
Applicable Regulations/Standards: Referenced Above in Table.
Resources:




1
Wisconsin Administrative Register, No. 702 – Effective Date July 1, 2014, Page 30 –
Available at: http://docs.legis.wisconsin.gov/code/register/2014/702b/register.pdf
“HIPAA Confusion Leading to Litigation: Health Care Providers May Continue to Charge
State Fee Schedules for Third-Party Medical Record Requests,” Davis, Wright, Tremaine,
LLC, February 15, 2015, Available at: http://www.dwt.com/HIPAA-Confusion-Leadingto-Litigation-Health-Care-Providers-May-Continue-to-Charge-State-Fee-Schedules-forThird-Party-Medical-Record-Requests-02-05-2015/
“Frequently Asked Questions About the HIPAA Privacy Rule,” Office of Civil Rights,
2002 - 2015
45 CFR. §164.524
Dunn, Rose. “Copying Records: The Saga Continues.” For the Record, 9, no. 7 (1997): 18-25
______________________________________________________________________________
 Copyright HIPAA COW
6
Version History:
Current Version: 4/17/15
Prepared by:
Reviewed by:
Content Changed:
Nancy Davis, MS, RHIA,
CHPS – Ministry Health Care
Privacy Networking Group
Amy Derlink, Privacy Officer
- IOD Incorporated
Changes to Actual Fees
Relevant at Time of
Publication
Kathy Johnson, Privacy
Officer - WI Dept. of Health
Services
Reference to Omnibus Rule
Guidance
Chrisann Lemery, MSE,
RHIA, CHPS, FAHIMA –
Avastone Health Solutions
Notation on Faxing
Previous Version: 10/04/04
Prepared by:
Reviewed by:
Nancy Davis, MS, RHIA,
CHPS
Privacy Networking Group
Susan Manning, JD, RHIA
Original Version: Unknown
Prepared by:
Reviewed by:
[List names here]
[List names and/or
Networking Group here]
______________________________________________________________________________
 Copyright HIPAA COW
7