Acceptable means of patient communications - Records

May 2, 2013

Question:

Hi Jennifer,

Thank you for Tuesday's email, it was very helpful.  Just a follow up question - what about when I need to get a patient their record?  Can I use email? 

Thanks,
Dr. F

Answer:

Yes.  You are authorized to email records, however, the same rules apply.  Any patient record containing protected health information may only be transmitted securely. Be sure to abide by your security policy so that you have proper physical, technical and administrative safeguards in place.  Emailing through encryption, password protection, etc. is appropriate for transmission of records.  You may also wish to switch to a patient portal system where patients have their own password and may access their records securely through your system.  So long as such a system is set up and maintained securely, you will be able to utilize same to communicate directly with and transmit records to patients. 

Electronic records may also be transmitted to a patient by way of a storage device.  You are authorized, explicitly, under the new Omnibus rule to charge the patient for any storage device you are giving to them for their records.  You are also authorized to pass through the cost of worker time creating the records for the patients.  However, caveat emptor - buyer beware - passing along "miscellaneous" creation costs is also an easy way to find you and your practice reported to the Office for Civil RIghts for a HIPAA violation.  Be sure you can substantiate any charges to be rendered to the patient.  Not sure you are charging properly - you probably are not.  Consult with your healthcare attorney to discuss proper fees under the new HIPAA Rules.