HIPAA requires a healthcare facility to retain medical records for at least 6 years, whereas most state laws require additional years of retention. The provider only assumes all costs for the maintenance and storage of records for 6+ years. In states covered by federal guidelines, medical records belong to the provider, practice, or institution that created the record. Traditionally, it has been assumed that the medical record belongs to the patient because the information is about the person. However, as the table above shows, twenty States have definitively decided that the medical record belongs to the provider or institution that created the record. The other states are reverting to federal regulations and HIPAA guidelines. Under HIPAA, the patient must receive copies of their medical records upon request, but they may be charged a reasonable fee to provide that copy. The last state, New Hampshire, decided that the patient had the medical record. Why is this debate about ownership such a common topic? It is most often discussed when a patient has to pay for a copy of their medical record and does not understand why. While the information belongs to the patient, the physical medical record belongs to the provider. In many states, the law is on Dr. Sharma`s side.
There is only one state in the United States that explicitly says that patients own their medical records: New Hampshire. There are 21 states where the law states that medical records belong to the hospital or doctor.2 New challenges require innovative solutions – often in the form of new technologies that make life easier. Certainly, technology has advanced healthcare to improve and extend our lives. But perhaps more visible in the medical field than in other fields, we see the clash of technology and standard practices. These documents are considered legal documents governed by the laws of the state and then of the country in which they are created. The table below shows whether your state has its own laws or whether your state falls under federal guidelines that, empirically, do not specify who owns the dataset. HIPAA states that, with very few exceptions, the patient owns their own information and has the right to receive a copy of the information. The question for the EHR provider is: if the physician ceases to practice, who is responsible for record keeping during the legal retention period (which could last for decades if minors are taken into account, since the countdown usually starts ticking once patients reach adulthood)? Most contracts state that doctors own them (or that the seller owns them). In general, the provider has the right to grant or deny access. This makes ownership a point of contention, because if the physician cannot access it to provide care, transfer the information to another provider, or hand over the record to the patient (a patient entitlement under HIPAA), then the records are essentially held hostage, which is not allowed. Even HIPAA states that a physician cannot withhold medical records until payment for treatment is made, but these providers can and do.5 What you can do What can doctors do now, especially if they have little bargaining power? Read contracts with EHR providers and negotiate using the law.
Doctors should read contracts carefully anyway. Given the incredibly broad authorization, EHR providers need to use data in a variety of ways. Selling to doctors` offices is far from the only business model for EHR providers. The data part is indeed much more lucrative. To further complicate matters, laws regarding patient data and record ownership can vary from state to state. Some states may claim that patients own all their data, including medical records, while other states believe that patients own their data, but health organizations own the medical records. From a legal perspective, ownership of medical data and records is confusing, but the focus should really be on how this data is accessed and used to improve patient health. Königlich, K. (2019). WHO OWNS PATIENT RECORDS? []. The Journal of Urgent Care Medicine.
Excerpt from www.jucm.com/owns-patient-medical-records/ However, there are also concerns that better patient access could lead to confusion. The classic example is that of a doctor using the acronym SOB. In medical terms, this means shortness of breath, but there are other obvious interpretations a patient may have. Physicians worry that they will have to spend more time explaining their notes to patients and less time explaining their notes to actual care. The pilot study mentioned above did not show this, but it is likely that it will have to be accepted more widely before many cynics buy into it. At Beth Israel Deaconess Medical Center in Boston, a pilot project is underway that provides access to psychiatric notes. It will be interesting to see what he shows. It is possible that patients like Rachel will do very well with more direct access to medical information. Kyle Jones, MD, is a faculty member in the Family Medicine Residency Program at the University of Utah at Salt Lake City. He is the Director of Primary Care for the Neurobehavior HOME program, a patient-centered medical home for people with developmental disabilities. You can follow him on Twitter @kbjones11.