A recent Yale study revealed that a large number of American hospitals fail to provide patient records upon request. The research was based on simulated patients requesting medical records and was conducted in 83 of the best hospitals in the US, all of which have independent medical records request processes and medical records departments, reachable by phone.
HIPAA requires healthcare providers to fulfill medical record requests within 30 days of receiving them. Records must be provided in the format requested by the patient when possible. However, hospitals have the right to charge a reasonable, cost-based, fee for copying services, supplies, postage and providing a summary of the records (if requested by the patient).
To determine the hospitals' levels of compliance, the researchers used simulated patients to conduct interviews with patient records departments and obtained medical records release forms. Information from these two sources includes the type of data that patients can request, formats in which patient records can be released, as well as fees and processing times. This information varies from hospital to hospital.
The study revealed that of the 83 hospitals stating it was possible to release all medical records, only 44 of them had that option available on the release forms. Similar discrepancies were found in the information given regarding the way that medical records could be released. Moreover, almost 50 hospitals charged more than the federal recommendation and seven hospitals did not comply with the legal processing time requirement.
Dr. Harlan Krumholz, a professor at the Yale University School of Medicine, believes that the lack of transparency in the release process is what leaves patients confused. This failure to comply with critical HIPAA requirements is worrying and raises questions on how well policies for PHI regulations are enforced.
Recently, the Trump administration launched the MyHealthEData initiative, which aims to improve patients' access and use of their medical records. It intends to give patients control over their own data and the ability to share it with whomever they wish using their application of choice.