Note for Eagle Associates HIPAA Compliance System subscribers:
Upcoming Webinar:
HIPAA and the Right of Access
August 7, 2025 12:00 PM EDT
This 45-minute webinar will cover the patient’s right of access to their designated record set, forms to use for records requests, form and format of access, fees for providing copies of records, unreasonable measures that are prohibited, records from other providers, methods of transmission, the difference between authorizations and records requests, and the right to inspect.
Can’t attend the live event? Go ahead and register and we will send you the recording after the webinar.
Form and Format
Some organizations receive a large volume of records requests. Processing these requests involves a considerable amount of labor. Questions often arise regarding the form and format of providing access to a patient. HHS guidance states:
“The Privacy Rule requires a covered entity to provide the individual with access to the PHI in the form and format requested, if readily producible in that form and format, or if not, in a readable hard copy form or other form and format as agreed to by the covered entity and individual. See 45 CFR 164.524(c)(2)(i). If the individual requests electronic access to PHI that the covered entity maintains electronically, the covered entity must provide the individual with access to the information in the requested electronic form and format, if it is readily producible in that form and format, or if not, in an agreed upon alternative, readable electronic format. See 45 CFR 164.524(c)(2)(ii). The terms “form and format” refer to how the PHI is conveyed to the individual (e.g., on paper or electronically, type of file, etc.) Thus:
Requests for Paper Copies – Where an individual requests a paper copy of PHI maintained by the covered entity either electronically or on paper, it is expected that the covered entity will be able to provide the individual with the paper copy requested.
Requests for Electronic Copies – Where an individual requests an electronic copy of PHI that a covered entity maintains only on paper, the covered entity is required to provide the individual with an electronic copy if it is readily producible electronically (e.g., the covered entity can readily scan the paper record into an electronic format) and in the electronic format requested if readily producible in that format, or if not, in a readable alternative electronic format or hard copy format as agreed to by the covered entity and the individual.
Where an individual requests an electronic copy of PHI that a covered entity maintains electronically, the covered entity must provide the individual with access to the information in the requested electronic form and format, if it is readily producible in that form and format. When the PHI is not readily producible in the electronic form and format requested, then the covered entity must provide access to an agreed upon alternative readable electronic format. See 45 CFR 164.524(c)(2)(ii). This means that, while a covered entity is not required to purchase new software or equipment in order to accommodate every possible individual request, the covered entity must have the capability to provide some form of electronic copy of PHI maintained electronically.; It is only if the individual declines to accept any of the electronic formats readily producible by the covered entity that the covered entity may satisfy the request for access by providing the individual with a readable hard copy of the PHI.”
Some organizations have wondered whether they can discontinue provision of records in certain formats, such as on CD. Because the HHS guidance states that you should provide access in the requested form and format if you are able to do so, it is not advisable to deny a patient’s requested format. However, you may charge a cost-based, reasonable fee for providing records.
The fee charged can include labor costs for transferring data to the requested media and for executing a mailing if applicable, media costs, actual postage costs, and supplies such as envelopes. You may not charge any compliance fees, infrastructure fees, etc. Essentially you will just be recouping actual costs involved in preparing and providing the record.
You may not tell patients that the only way to obtain a copy of their record is to use the patient portal. You can encourage it and explain that it is convenient and secure, but it is considered an unreasonable measure to tell patients that the portal is the only option to obtain a copy of their record.
