Confidentiality, Privacy & Security

Hi-Tech Requests and Affidavits

  • 1.  Hi-Tech Requests and Affidavits

    Posted 02-08-2019 11:48
    ​Good morning,

    We are seeing an increase of Hi-Tech patient directive requests flowing through our release of information department from attorney's offices.  I wanted to see if anyone is charging a certification fee in addition to the flat fee when an affidavit is requested to accompany the records.  I have not read anywhere that you can not charge the $20.00 certification fee.

    Any insight to this would greatly be appreciated!

    ------------------------------
    Jamie Glenn
    Corporate Him Director
    Methodist LeBonheur Healthcare
    ------------------------------


  • 2.  RE: Hi-Tech Requests and Affidavits

    Posted 02-11-2019 11:25
    ​In my state (WI) we cannot charge certification fees for other state law reasons, but there is some HHS/OCR commentary from 2013 when the HITECH rules first came out that you might want to review to help make your decision.  The commentary (pasted below) is found in the January 25, 2013 Federal Register p. 5636.  The commentary states that they do not consider the cost to prepare an affidavit to be a copying cost and therefore the preparation of the affidavit is not subject to a cost based fee requirement.

    Comment: One commenter suggested

    that labor-related costs should include

    preparation of an affidavit certifying

    that the information is a true and correct

    copy of the records.

    Response: We do not consider the cost

    to prepare an affidavit to be a copying

    cost. Thus, where an individual requests

    that an affidavit accompany the copy of

    protected health information requested

    by the individual for litigation purposes

    or otherwise, a covered entity may

    charge the individual for the

    preparation of such affidavit and is not

    subject to the reasonable, cost-based fee

    limitations of @ 164.524(c)(4). However,

    a covered entity may not withhold an

    individual's copy of his or her protected

    health information for failure by the

    individual to pay any fees for services

    above and beyond the copying, such as

    for preparing an affidavit.



    ------------------------------
    [Peg] [Schmidt]
    [Chief Privacy Officer]
    [Advocate Aurora Health][peg.schmidt@aurora.org]
    ------------------------------



  • 3.  RE: Hi-Tech Requests and Affidavits

    Posted 02-11-2019 12:03
    Thank you so much for your response.  This is extremely helpful.​

    ------------------------------
    Jamie Glenn
    Corporate Him Director
    Methodist LeBonheur Healthcare
    ------------------------------



  • 4.  RE: Hi-Tech Requests and Affidavits

    Posted 02-12-2019 10:36
    Good info Peg! But let's make the complex more complex (like OCR has done with patient directed requests), I'm no lawyer but I have spoken with those who are and they say if a request is coming from an attorney for some kind of certified record, it's not a patient access request. It requires third party authorization, which requires a correct authorization form, not some patient access request form they dreamt up that isn't an authorization form. The lengths some of these attorney's are going to to avoid a few bucks is incredible. There was an article in the Journal a while back about this subject, or at least close to it, Posted By AHIMA Staff on Apr 1, 2017 April Journal Four Questions to Consider When Releasing Information to Attorneys.

    ------------------------------
    Kelly McLendon, RHIA, CHPS
    Managing Director
    CompliancePro Solutions
    kmclendon@complianceprosolutions.com
    321-268-0320
    ------------------------------



  • 5.  RE: Hi-Tech Requests and Affidavits

    Posted 02-21-2019 13:49
    Hi, Kelly,

    I appreciate your response. Here is one scenario I'm recently immersed in with an attorney using the loophole for their benefit.  Usually this particular firm will ask for abstract copies to review for a potential client's case.  Every so often, we would receive a request for a complete certified copy from them, most likely for a case that will end up in court.
    NOW, just within the last week, this firm has caught on to providing a patient directive "written and signed by the patient" with EVERY SINGLE REQEUST, and they are asking that EVERY SINGLE REQUEST be a complete certified copy just because they can.  It defeats only providing minimum necessary, and it's breaking my department financially.  OCR has made it entirely too complicated to even begin to come up with a calculated cost associated with labor and supplies at this point so we're most often forced to use the flat $6.50 rate instead.

    I was unable to find the article you mentioned previously, but I'm going to look again.  I'm in the process of working with my ROI vendor to incorporate a charge type associated with a Legal Patient Directive + Certification fee.  Not sure how long that will take... But we absolutely need more clarification on what constitutes a Patient Access request vs. someone taking advantage of the legal loopholes.

    Any additional articles, feedback, etc. on this topic would be greatly appreciated!!




    ------------------------------
    Jamie Glenn
    Corporate Him Director
    Methodist LeBonheur Healthcare
    ------------------------------



  • 6.  RE: Hi-Tech Requests and Affidavits

    Posted 02-21-2019 15:05
    Hi Jamie,

    So sorry to hear of the abuse, which from our perspectives is what it is. To me, you are thinking correctly. Create tight polices, procedures and training and stick to the processes, with ample documentation. Call patients sf there is ever really a question, but that is too burdensome for high volumes of requests. The certified copy request is the fact that really puts these requests over the top and illustrates that are not patient access requests. OCR knows all of this of course, but has not issued guidance to stop it. You may very well get complained to OCR about this and that is nothing but bad news, but if you have all your documentation and processes well put together hopefully that will be enough. Since this is such a risky area I'd engage your legal counsel to make sure they concur.

    Be aware that AHIMA recently submitted a response to an OCR RFI (Request for Info) where they addressed this topic and asked for clarification, but beyond that maybe reworking of the disclosure rules, which I found very complex. There were many questions surrounding disclosures. AHIMA had to keep their responses succinct and I know they, along with CSA's like FHIMA (Florida) and the ROI industry have  adequately illustrated the issues to OCR. So AHIMA responded, but not with a lot of detail, again to me that wasn't needed, everyone is aware of the problems, including those who wrote the guidance in 2016 that caused all these issues.

    As for materials on this subject I have several. I'm going to attach the article and the AHIMA response.

    Also look-up AHIOS, the ROI industry's trade association. They have a lot of materials, including video's. I'll stop short of saying I fully agree with all of their points, but these are well produced and informative materials. They should help you make a case for your position going forward on fulfilling these types of requests.

    Hopefully these will help you, just know you are not alone, I'm sorry to say!




    ------------------------------
    Kelly McLendon, RHIA, CHPS
    Managing Director
    CompliancePro Solutions
    kmclendon@complianceprosolutions.com
    321-268-0320
    ------------------------------



  • 7.  RE: Hi-Tech Requests and Affidavits

    Posted 02-21-2019 15:09
    You are awesome!  Thank you so much for all of your feedback, info sharing and resources!  It does help to know that others are in the same boat.  It is beyond frustrating.  ​

    ------------------------------
    Jamie Glenn
    Corporate Him Director
    Methodist LeBonheur Healthcare
    ------------------------------



  • 8.  RE: Hi-Tech Requests and Affidavits

    Posted 02-12-2019 21:52
    Absolutely charging the certification. The intent of HiTech is provide patients access to their records.  Happy to provide the record but if they want certification that is nothing to do with patient access.  Hopefully OCR would agree.

    The information transmitted in this message (including any attachments) is intended only for the person or persons to whom it is addressed, and may contain material that is confidential and/or privileged. Any review, re-transmission, dissemination or other use of the information contained herein by persons or entities other than the intended recipient is prohibited. If you have received this message in error, please notify the sender immediately and delete this message.





  • 9.  RE: Hi-Tech Requests and Affidavits

    Posted 02-12-2019 23:09
    Our office receives these type of requests and what we do is replace the affidavit with a certification.  We do this because we can't charge the fee for the affidavit.

    ------------------------------
    Terasa Williams
    Medical Records Manager
    ------------------------------



  • 10.  RE: Hi-Tech Requests and Affidavits

    Posted 02-21-2019 14:18
    Also, just wanted to share the following blog that a colleague happened to come across and shared with me.  Here is a snippet of the opening title and lines with a link:
    Title: "​A guide for attorneys who need to request medical records but don't want to pay hundreds of dollars for them."
    Opening Paragraph: "A significant part of our pre-litigation effort is getting our client's medical records. By using the following system, we keep our medical records costs down-and I mean really down. We rarely pay more than $10 per provider."

     https://thelockefirm.com/hitech

    So...essentially, we're helping attorneys keep their costs down...this fella even says it.  How do we fight for us and our patients.  I can guarantee you patients have no clue how much information control they're giving to people just by being promised smaller legal fees by signing a piece of paper.

    ------------------------------
    Jamie Glenn
    Corporate Him Director
    Methodist LeBonheur Healthcare
    ------------------------------



  • 11.  RE: Hi-Tech Requests and Affidavits

    Posted 02-21-2019 15:43
    Just my opinion, but not only is that link from the attorney disgusting, but it's full of misinformation, starting with calling a patient directed request a 'HITECH' request and using the term 'illegal' invoice. In point of fact there has always, since what 2004 in the HIPAA Privacy Rule's inception, been a right for a patient to request copies. In spring of 2016 OCR added wording to their website to allow patient's to direct records be sent to third parties, this is what many attorney's have perverted.  It's scary to me to think that those actively engaged in the law can be so flippant and irresponsible in saving a buck. There is no doubt that asking for certification of records is a key indicator that these requests are for legal purposes, not patient access purposes. In my non-legal opinion when they purposefully circumvent the law for their own benefit, e.g. trying to submit a patient access request when the law calls for a third party authorization, they could be breaking the law.

    Although I don't pick fights, I'm stubborn, my advice is to make your policies and enforce them. Use as much info as you can get your hands on and be prepared to fight. Again, this is why your legal counsel needs to help, it's not a fair fight for non-lawyers to fight attorney's. I know legal counsel that can make your arguments, they are out there, but many times it requires a legal professional that knows HIPAA to adequately defend against this kind of abuse. We sent OCR an example of a bogus form that an attorney had not even bothered to remove the 'insert copied patient signature' in their patient request template, basically committing fraud taking signatures from an authorization form and pasting them into some weird made up patient access form. OCR has not been helpful in solving this issue, their video, which is posted on the ONC website I think, really says to call the patient, but that's unreasonably burdensome in a high volume situation, again my opinion.

    The major ROI companies are dealing with this everyday, in the example listed they actually name CIOX, who along with MRO and other ROI companies are in this battle. If you use a ROI company get with them to set your strategy. Again, AHIOS has covered this ground.

    We did create a patient access form and there is at least one practice brief addressing the topic of patient access request in the AHIMA BOK (Body of Knowledge). All were created knowing these issues with the attorney's existed. The issues have gotten worse over time and OCR is getting inundated with complaints. All because of a few words changed in their guidance and the law of unintended consequences. Amen.

    Hope this helps!


    ------------------------------
    Kelly McLendon, RHIA, CHPS
    Managing Director
    CompliancePro Solutions
    kmclendon@complianceprosolutions.com
    321-268-0320
    ------------------------------



  • 12.  RE: Hi-Tech Requests and Affidavits

    Posted 02-27-2019 10:34
    ​Not to beat a dead horse, BUT I had to share a conversation that  I just had with one of my associates.  She received a call from an attorney's office who had some questions about the records they received from the opposing attorney's office who actually requested the records from us.  The caller asked the following question,  "why did attorney 'so and so' charge us $650.00 for the records they received from you all?"  Instead of my associate saying "well, they only had to pay $7.11 so they totally scammed you?"  My associate simply said, "I don't know.  I'm not sure how they handle their duplication charges."

    Just thought this was a very enlightening example of how attorney's are trying to say that, by utilizing the hi-tech loophole, they are saving money for our mutual patients/clients, when in reality, they are using this to make more money off of the system. ....I doubt they're going to give the patient a credit in the amount of $642.89.  Do you???

    ------------------------------
    Jamie Glenn
    Corporate Him Director
    Methodist LeBonheur Healthcare
    ------------------------------



  • 13.  RE: Hi-Tech Requests and Affidavits

    Posted 02-27-2019 14:13
    @Jamie L Glenn, RHIA I wonder if you could submit this example to the OCR as supporting documentation of why these regulations are flawed?​​

    ------------------------------
    Shannan Swafford
    Manager Coding Process Improvement
    ------------------------------