September 21, 2019

September 20, 2019

Subscribe to Latest Legal News and Analysis

September 19, 2019

Subscribe to Latest Legal News and Analysis

Many Lessons Still Need to be Learned regarding Patient Access to Health Care Information

The Office of the National Coordinator for Health Information Technology recently released a report (the Report) detailing user experience research on patient access to health data. The Report sought to examine the experiences of 17 individuals and processes of 50 health systems, with commentary from four medical record fulfillment administrators, to determine how the medical record request process can be improved for consumers. The Report ultimately concludes that patients and health care providers alike are in need of a well-defined process that is convenient, expedient and transparent.


The Health Insurance Patient Portability and Accountability Act (HIPAA) does not create a uniform process for storage and production of medical records across providers, and in-turn did not create a convenient request process for patients. Generally, patients have a right to access a designated record set, which includes 1) medical records and billing records about individuals maintained by or for a covered health care provider; 2) enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; and 3) other records that are used, in whole or in part, by or for the covered entity to make decisions about individuals. Upon receipt of a request by a patient to access their health records, the covered entity receiving the request must produce the records within 30 days. Prior to producing those records, however, the covered entity must verify the identity of the individual making the request. This often involves signature verification or similar processes.

Themes of the Report

The Report examines the process through the idea of “shared needs,” which is reflective of the fact that the patient request process should be a collaborative undertaking, although it often functions in a manner that appears more like a game of telephone than a collaborative effort. The Report identifies four main issues stopping the patient record request process from being convenient, which it expresses in greater detail through the employment of different patient personas.

  1. Complete and accurate records

Patient records are often incomplete, preventing patients from getting access to a complete health history, and preventing providers from gaining a full understanding of the patient they are treating. Physical copies of medical records remain stored in basements of hospitals and medical office buildings, creating fragmentation in the record and preventing providers from implementing a streamlined process that supports ease-of-access to produce a complete record consistent with the patient’s request. Patient records are cited to often contain mistakes or are missing sections of care, which in turn creates duplicative testing and procedures. Without a complete and accurate health record, providers are stymied from improving coordination of care and empowering patients to lead the charge on their own health, and this challenge will likely only grow as individuals become more mobile – seeking care “on the go” using mobile devices – unless there is a greater focus on addressing certain IT and operational challenges and inefficiencies, including interoperability.

  1. Online records management

As noted with complete and accurate records, many patient records are still stored on paper, and the digital systems in place currently are not necessarily intuitive for the patient. Patient portals were frequently cited in the Report as confusing. Often, patients are forced to travel to pick up physical copies of their records, even in instances where the provider could have scanned the records and placed them on a CD due to lack of education on the proper manners of disclosure. This places a substantial burden on patients, particularly those dealing with chronic conditions that may be more likely to need access to their health records.

Commentators have also expressed concern that the shift to patient portals and online access to medical records, while encouraging patient participation in their own care, may leave certain segments of the population behind, including the elderly. Balancing convenience, access and operability is frequently easier said than done.

  1. Portable records

The Report notes that patients rarely are requesting access to their patient records well in advance of their need for them. Instead, patients often request their records right when they need them, or only think to begin the request process immediately before an appointment with a new physician. Without a single portal to request all relevant patient records across providers, the request process results in a disjointed and varied attempt to gain a complete record in an accessible form. This becomes further complicated in instances where a patient is changing or adding a provider, and the new provider receives paper copies of the record but fails to create an electronic copy. The current transfer process continues to inhibit patient records from becoming truly portable, despite the initiatives to switch to electronic health records and create consumer-friendly digital systems that are interoperable between providers.

  1. Transparency in the Records Request Process

The Report describes submitting a request for health records was as a “black box” process. Once patients submit their requests for their health records, they often wait without any indication of when they might receive the record. This creates an additional stress for patients, and often results in additional call volume to hospitals and physicians offices to confirm the request was ever received, or patients following up in-person unexpectedly. After the request is received, however, the provider is faced with the challenge of verifying the identity of the requestor prior to sending the medical record. This is only the first step, as the forms used to request records are often confusing to the patient, meaning the information request is incomplete, and follow up questions need to be asked. The lack of communication was frequently cited in the Report as a key source of patient frustration.

Suggestions To Improve The Patient Request Process

The Report concludes with the suggestion of how the patient record request process can be improved for both patients and providers. These suggestions take into account the key to the process: allow the patient to communicate their needs clearly, and enable the provider to produce the records in an efficient manner. The Report’s suggestions include:

  • Allowing patients to easily request and receive their records from their patient portal.
  • Setting up an electronic records request system outside of the patient portal.
  • Creating a user-friendly, plain language online request process.
  • Using e-verification to quickly confirm the record requestor’s identity.
  • Including a status bar or progress tracker so consumers can see where they are in the request process.
  • Making sure consumers know that they can request their record in different formats and delivered in the way they choose.
  • Providing user friendly, plain language instructions for patients and caregivers on how to request health records, what to expect, and who to contact with questions.
  • Encouraging patients to use patient portals by promoting features like online appointment scheduling, secure messaging, and prescription refills.
© 2019 McDermott Will & Emery


About this Author

Marcus Ryan, Mc Dermott Law Firm, General Healthcare Attorney

Ryan B. Marcus maintains a general health care practice. He advises hospitals health systems, and health industry clients on a variety of regulatory and transactional matters, including mergers, acquisitions, affiliations, and joint ventures.

While in law school, Ryan was editor-in-chief for the Annals of Health Law and a student fellow at the Loyola University Chicago Institute for Consumer and Antitrust Studies. He served as a judicial extern for the Honorable Virginia M. Kendall in the United States District Court for the Northern...

Lisa Schmitz Mazur, Health Law Attorney, McDermott Will Law Firm

Lisa Schmitz Mazur is a partner in the law firm of McDermott Will & Emery LLP and is based in the Firm’s Chicago office.  Lisa maintains a general health industry practice, focusing on the representation of hospitals and health systems and other health industry providers.

Lisa’s representation of hospitals and health systems includes providing guidance on not-for-profit corporate governance matters, tax-exemption issues, conflict of interest compliance and overall corporate compliance effectiveness.  In addition, Lisa regularly assists hospital and health system clients to develop and negotiate physician compensation programs, and prepare agreements with physicians and helps to guide governing boards and committees in the review and approval of such arrangements. 

Digital Health

Lisa advises a variety of healthcare providers and technology companies involved in “digital health” – the intersection of health software applications, analytical tools, medical technology and electronic data assets enabled by the Internet and mobile devices – on the applicable legal and regulatory infrastructure, with a particular focus on telehealth, telemedicine, mobile health and consumer wellness programs. For example, Lisa has assisted numerous clients in developing and implementing telemedicine programs by advising on issues related to professional licensure, scope of practice, informed consent, prescribing and reimbursement. Lisa assists her clients to identify and understand the relevant legal issues and develop and implement practical, forward-thinking solutions and strategies that meet the complex and still-evolving digital health regulatory landscape.

In addition to writing extensively on matters related to her digital health practice, Lisa has spoken at numerous conferences on a variety of digital health topics. She is the co-editor of McDermott’s Of Digital Interest  blog, co-chairs the Interstate Collaboration in Healthcare Stakeholder Group and chairs the Illinois Telehealth Law Forum Program Planning Committee

Lisa also co-leads the Firm’s Digital Health affinity group, which brings together McDermott lawyers from within and outside the Health Industry Advisory Practice Group to develop thought leadership, share information and collaborate on best practices.