Patient Access Playbook: Putting it into practice

The first step to operationalizing patient electronic access is understanding the capabilities of your EHR technology.

If your EHR is properly certified by the Office of the National Coordinator for Health Information Technology, then it should have certain minimum capabilities. But those capabilities won’t do you much good if you are not familiar with them. Your EHR vendor should be a partner in understanding how to use the EHR to improve patient engagement. Consider contacting your vendor and asking for a tour of its patient engagement features.

Secondly, it is critical that your office remember the following key points:

• Patients have a right to view or obtain a copy of their medical and billing information.
• There are limitations to what and how much you can charge patients to provide them with their records. Providing access to your patients’ records should not be viewed as a revenue-generating opportunity. Electronic access, in particular, should be available for little or no cost.
• Patients are not required to use the patient portal and can obtain copies of their medical information through alternative means.
• A patient’s access cannot be denied simply because the practice believes that access is not in the patient’s best interest.
• A patient can receive their medical records through unencrypted email if warned of the risk of unauthorized access in transit.
• If a request comes from a third-party and does not appear to be at the patient’s direction, then a HIPAA-compliant authorization form is required. If you are unsure whether a third-party request is at the patient’s direction or the third-party’s direction, then we recommend contacting the patient to confirm that the request is at their direction.
• If a patient would like a copy of their medical record sent to a third-party, they have a right to have the practice do so.
• Your patients may be eager to receive their records for any number of reasons, including needing to schedule additional appointments with specialists. Try to let your patients and their caregivers know when you have received their record request and, if possible, an estimated timeline for when they can expect to receive the records. This type of communication can help to relieve significant anxiety and improve trust and communication between the practice and your patients. It can also help eliminate redundancy and inefficiency while improving patient safety and outcomes. Also consider implementing a system allowing patients to flag emergency requests versus those that are more routine.
• Remember that many patients are sick and have asked family members or other caregivers to help them access their records. Try to work with these caregivers to provide access in accordance with the patient’s wishes. You can always call the patient if you need to double-check about whether to give the caregiver a record.

The Patient Access Playbook (PDF) focuses on dispelling HIPAA myths and helping physicians understand their obligations to provide patients with access to their health information.