An Open Letter to the People Who Brought Us HIPAA

Also a lot of the state laws seem to "allow" fees that are blatantly disallowed. (Alabama, search fee of $5; Arkansas, Retrieval fee for offsite records; California, clerical costs in locating...)

From page 14 of HITECH it outlines precedence vs state laws. It usually sides with the individual (it defers to state law when state law gives more privacy/access rights). On fees, the QA period that preceded the finalization of HITECH explicitly disallows retrieval fees and has more explanation on what constitutes "reasonable fees".

The "RFC" [1] says on pages 70-71 of the pdf:

"With respect to providing a copy (or summary or explanation) of protected health information from an EHR in electronic form, however, section 13405(e)(2) of the HITECH Act provides that a covered entity may not charge more than its labor costs in responding to the request for the copy."

And (emphasis mine):

"While we did not propose more detailed considerations for this factor within the regulatory text, we retained all prior interpretations of labor with respect to paper copies—that is, that the labor cost of copying may not include the costs associated with searching for and retrieving the requested information. With respect to electronic copies, we asserted that a reasonable cost-based fee includes costs attributable to the labor involved to review the access request and to produce the electronic copy, which we expected would be negligible."

And in response to comments (re: Electronic):

"We clarify that labor costs included in a reasonable cost-based fee could include skilled technical staff time spent to create and copy the electronic file, such as compiling, extracting, scanning and burning protected health information to media, and distributing the media."

Also:

"...in this final rule we clarify that a covered entity may not charge a retrieval fee (whether it be a standard retrieval fee or one based on actual retrieval costs). This interpretation will ensure that the fee requirements for electronic access are consistent with the requirements for hard copies, which do not allow retrieval fees for locating the data."

Finally, delineating costs when state law has something to say:

"When a State law provides a limit on the fee that a covered entity may charge for a copy of protected health information, this is relevant in determining whether a covered entity’s fee is ‘‘reasonable’’ under § 164.524(c)(4). A covered entity’s fee must be both reasonable and cost-based. For example, if a State permits a charge of 25 cents per page, but a covered entity is able to provide an electronic copy at a cost of five cents per page, then the covered entity may not charge more than five cents per page (since that is the reasonable and cost-based amount). Similarly, if a covered entity’s cost is 30 cents per page but the State law limits the covered entity’s charge to 25 cents per page, then the covered entity may not charge more than 25 cents per page (since charging 30 cents per page would be the cost-based amount, but would not be reasonable in light of the State law)."

All that together implies to me that HITECH would overrule all allowances for search/retrieval/other fees specified by state laws to zero."

[1] https://www.federalregister.gov/articles/2013/01/25/2013-010...

Brief technical outline (not on that page, as most people don't "care"): - SSL for all API endpoints - No data stored on the phone (unless you send to Health) - No credentials stored on server (without special case explicit permission) - Data at rest stored encrypted - but we have the keys - Automatic security updates nightly, faster for events such as Heartbleed: https://twitter.com/stayinyourprime/status/45370574409788211... - Threat monitoring software on all production servers and periodic vulnerability scans.