Ruling Changes HIPAA’s Third-Party Directive Requirements


Patients' right to access their health information is a core patient right protected under the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH Act). The HIPAA Omnibus Rule, which went into effect in 2013, strengthened and expanded the rights patients have to access their protected health information.

The Third-Party Directive and HIPAA’s Fee Limitations

One of those rights, known as the “third-party directive”, is the right of the patient to tell a healthcare provider to send a copy of the patient’s health information to a third party designated by the patient. This right may be invoked by patients to have their health records sent to any third party, including a family member, another doctor, or an attorney.

The HIPAA Omnibus Rule expanded the third-party directive to require healthcare providers to send records to third parties “in any form and format requested by the individual, if it is readily producible in such form and format.” Previously, the third-party directive only applied to information contained in an electronic health record.

HIPAA also limits the fees a healthcare provider can charge a patient for providing access to the patient’s health records. In a 2016 guidance document, the U.S. Department of Health & Human Services (HHS) clarified that the fee limitation applies not only to a patient’s request for their own records, but also to requests that the patient’s records be sent to a third party.

Court Ruling Leads to Changing Guidance

A recent federal court decision struck down two aspects of the HIPAA Omnibus Rule relating to the third-party directive. First, the court limited the third-party directive to requests for a copy of the patient’s electronic health record in electronic format only. Second, the court ruled the fee limitation does not extend to record requests transmitted to third parties.

HHS’ Response

In response, HHS released a notice of this ruling and indicated the fee limitation will only apply to patients’ requests for their own records, and does not apply to a patient’s request to transmit records to a third party. The HHS Notice further states, “The right of individuals to access their own records and the fee limitations that apply when exercising this right are undisturbed and remain in effect.”

How These Changes Affect Healthcare Providers

While these changes will ease some burdens for healthcare providers and medical record retention companies, they are limited in scope and only apply to third-party directives. Healthcare providers must continue to review their internal practices and policies to ensure they are complying with HIPAA’s requirements regarding patients’ rights to access their own health information.

If you have any questions about how these changes to the HIPAA guidance might affect you, please reach out to the attorneys on the Health Law team.

Related Services

Jump to Page