Earlier this year, OCR released a fact sheet and two sets of Frequently Asked Questions (FAQs) to clarify aspects of individuals’ core right under the HIPAA to access and obtain a copy of their health information.
Today, in response to questions received after release of the guidance, OCR provides further clarification about the amount that an individual may be charged for a copy of their protected health information (PHI). Specifically, we clarify in a new FAQ that $6.50 is not the maximum amount that can be charged for all individual requests for a copy of PHI under the right of access. Rather, charging a flat fee not to exceed $6.50 is an option available to those entities that do not want to go through the process of calculating the actual or average costs for requests for electronic copies of PHI maintained electronically as permitted by the Privacy Rule. Entities may choose the fee calculation method that is most appropriate for their circumstances, within the boundaries of what is permissible under the Privacy Rule.