Disability Appeals in North Carolina  -   33 Years Experience
David R. Paletta
Disability Attorney

Raleigh, Durham, Chapel Hill, Boone
North Carolina

(919) 491-5643

The HITECH Act - a new tool for attorneys seeking medical records.

Published by David Paletta

Disability attorneys, workers compensation attorneys and personal injury attorneys spend thousands of dollars each year obtaining the medical records of their clients.  Historically, attorneys have used a HIPAA authorization to obtain these records.

HIPAA (the Health Insurance Portability and Accountability Act of 1996) has a Privacy Rule that gives individuals the legal right to obtain copies of their medical records.  This Rule requires HIPAA covered entities to provide individuals, upon request, with access to the protected health information ("PHI") about them in one or more “designated record sets” maintained by or for the covered entity.  A "designated records set" is defined at
45 C.F.R. §164.501 as a group of records maintained by or for a covered entity.

The Health Information Technology for Economic and Clinical Health Act, known as the "HITECH Act", provides attorneys with a new method to obtain medical records at substantial cost savings.  Pursuant to 42 U.S.C. §17935 (e) (1), if a covered entity maintains electronic health records ("EHR")

"the individual shall have a right to obtain from such covered entity a copy of such information in an electronic format and, if the individual chooses, to direct the covered entity to transmit such copy directly to an entity or person designated by the individual, provided that any such choice is clear, conspicuous, and specific, . . ."

Instead of using a HIPAA authorization, the attorney can use a HITECH request signed by the Client.  A HITECH request has three important advantages over a HIPAA authorization.

1.  Simplicity.  The HITECH request must

(i) be in writing;
(ii) signed by the Client;
(iii) identify the attorney and where to send the records.

Click on HITECH Records Request to see a sample request.  The necessary wording of a HITECH request is much simpler than the necessary wording of a HIPAA authorization.

2.  Time Deadline.  The covered entity must respond to a HITECH request within 30 days after the request is received.  See 45 C.F.R. §164.524 (b) (2) (i).  The HIPAA authorization does not have a time deadline.  

3.  Fees.  The fees a covered entity can charge to respond to a HITECH request are strictly limited by 45 C.F.R. §164.524 (c) (4).  In most cases, the fee cannot exceed $6.50. See HHS FAQ 45 C.F.R. §164.524 at page 15.  This fee limitation applies to any vendor hired by the covered entity to respond to the HITECH request.  See HHS FAQ 45 C.F.R. §164.524 at page 13.  Further, the HITECH Act is a federal law that supercedes all State laws pertaining to the cost of medical records.

Limitations.  A HITECH Records Request has two important limitations attorneys should be aware of.  First, it ONLY applies to electronic records.  If the health care provider only maintains paper records, the HITECH request does NOT apply.  Second, psychotherapy notes are exempt from a HITECH Records Request.  See 45 C.F.R. §164.524 (a) (1) (i).

Enforcement.  If your HITECH request is denied, I suggest you call the medical records supervisor.  If the call does not resolve the issue, I suggest you send a detailed letter with citations to the relevant authority, with attachments of the relevant authority, with a 10 day deadline for a response.  If that does not work, I suggest you file a complaint with the US Dept of Health & Human Services.  Click on "How to file a HHS complaint" to learn the correct procedure.

Practice Tips.  

1. The individual, NOT the health care provider, gets to choose the method for obtaining medical records.  See 45 C.F.R. §164.524 (b) (1) and (c) (2).  

2. The attorney should NOT send a HIPAA authorization with the HITECH request.  The HIPAA authorization might give the covered entity a basis to disregard the HITECH fee limitation.

Authorities.  The Federal legal authority for a HITECH Records Request can be read by clicking on the documents below.

42 U.S.C. §17935 (e).

45 C.F.R. §164.524.

HHS FAQ 45 C.F.R. §164.524.

Federal Register Vol. 78, No. 17, 1/25/2013, pgs. 5631 - 5637.

Sample Forms.

HITECH Records Request.

Attorney letter.

Response to denial of HITECH request.

This Article was updated by David Paletta on April 28, 2017.