Hostile HIPAA

Adding to my new experiences as a patient, I have now run into heretofore unforeseen side of the HIPAA monster. As a patient, it should be protecting me, right? Of course not! Legislated in part to protect privacy, HIPAA is one of the most misunderstood and abused laws by healthcare personnel, particularly clerical staff at the front lines of the patient-physician records interface who may not have much of a healthcare (or all that much educational) background to boot. 

In my case, I called wanting a report from a minor surgery a few weeks after I had it done. I had already called the surgeon’s office and they said that while they did have a copy via their electronic medical record (EMR), the actual operative report was the hospital’s property and they couldn’t give me a copy; they just had viewing privileges, I was told. In the past, I’ve received every copy of everything I’ve ever wanted. This “ownership” business was nonsense–after all, this was my surgeon and the paper copy was in my chart. As long as I was there and asked for it, a simple copy had always been made for me to walk out with said report in hand. To be clear, I’m talking about post-HIPAA, not some wistful recollection of the way things were back in the “good old days.” Said surgeon recently moved into a brand spanking new office, has a ton of new staff, and I just thought that this was just a miscommunication–escalating to a supervisor or the like should resolve the problem.

Obviously it didn’t, but the fun was just about to begin. My instructions–reasonable, I might add–were to contact the hospital’s medical records department since they “owned” the information, and they could help me further. It was speaking to the medical records (”MR” below, because I like the double-entendre) office that thing became unglued. Below is a faithful transcript of our conversation, edited only for general length and idle banter:

Me: [explain my needs] So what procedure do you have for me to get a copy of the report?
MR: You need to come by–in person only with a picture ID–fill out some paperwork and pay a processing fee that starts at $42.50 for first 10 pages.
Me: $42-what?! The report is just one page, I think–maybe 2 at most. I mean, it’s on the screen–just hit ‘Print’
Me: Doesn’t matter if it’s 1 page or 10; it’s the same price.
MR: But wait, my family doctor’s been FAXed records from here–did you charge his office too?
MR: No, we don’t charge physicians because the request is for continuation of care. If we give a copy to you it’s not for continuation of care, it’s for your personal use.
Me: But the same work is being done, you just aren’t charging the doctor but are charging the patient? So it’s not a cost recovery, you’re penalizing the patient.

MR: We give it to the doctor electronically [not true, only applies to affiliated doctors in same med center]. We charge you or an insurance company because we have to physically process the record [what, press "Print" from the screen interface?!?] If it the report is for a doctor, they can access it electronically.
Me: But the doctor is in [my home city, 35 miles away], he’s always gotten records by fax.
MR: Well, we just went live with our new system in October.
Me: But if your system wasn’t live, you’re still saying you would charge me and not him.
MR: That’s correct, but slightly less than $42.50.

Me: OK, but I’m saying my doctor I know has no login credentials to your hospital, no privileges, nothing. So how can he get a copy?
MR: I’m guessing he’ll have to apply for access, but–well–I don’t know–I’m not the one that handles that, but in the meantime if he can’t get to it online, someone will have to pull the records, process it [again, this is just a quick computer search that takes 5-10 seconds], and send him the records–
Me: –which is my point: you’ll have to send him the records manually, but you aren’t going to charge him for the same work you’re going to charge me–
MR:  –That’s right! [Proudly, as though she's won an argument b/c I'm agreeing, which was most disturbing]
Me:  –someone is going to have to physically process this–
MR: Yes sir! [again, defiantly]
Me:   –and send it to my physician without charging him.
MR: Yes, because it’s for continuation of care [emphasis theirs, spoken slowly] and that’s something very different.
Me: [previously explained about my having been in Mexico, do have a "continuation of care" issue for my own recordkeeping] I already told you, I need the records for a physician in Mexico.
MR: If you can provide us with the name and address, we can release the records to him and mail them.
Me: To Mexico?!?!
MR: Yes sir, we can mail them.

Me: You have no idea what mail is like in Mexico; it will take a month at least if at all. I doubt you’ll pay the $30 for FedEx for that one page. Besides, are you sure all these fees are consistent with HIPAA and state regulations concerning access, etc?
MR: Yes sir, I can even provide you with a fee schedule.
Me: Can you fax that to me?
MR: Of course, let me get your fax number.

And with that deliciously ironic ending, the “labor” and “pulling records” was equal to the fax of that one page which they were all too willing to perform for free so their fees could be proudly shared. The 10 minute phone converation could have pulled at least 5 records and faxed as many copies. This is robbery, plain and simple.

HIPAA was crafted for portability (change in jobs, location, etc. doesn’t make one “start over” in terms of coverage) and security/privacy above all. It is, in spirit, supposed to be protective of the insured at the unfortunate and unfunded responsibiity of the healthcare provider caught in between trying to both comply and do right by the patient. I sympathize with this, but to selectively push costs back on the patient and not a physician–or more to the point, another business entity capable of absorbing said costs as the price of doing business–is predatory and in stark contrast to the spirit of the law. Moreover, HIPAA left way too much open to vague enforcement with language like “reasonable fee.”  It’s no wonder that individual state agencies and other entities are pushing the envelope with what’s “allowable” at the patient’s (ie, the person most exploitable and vulnerable) expense.

In the end, I got my report–not by paying $42.50 to the hospital, but at my next surgeon’s visit, I simply asked him if I could get a copy.  Without hesitation, he said “Sure!” and directed his nurse to go up front and make a copy for me on my way out.  Done. Piece of cake. HIPAA be damned.