Secret Shoppers Seeking Patient Records From Top Hospitals Find Uneven Results

Top hospitals vary in their HIPAA-mandated responses to patient records requests, and researchers suggest it may be time for the government to toughen penalties for noncompliance.

Many of the nation's top hospitals are doing an uneven job of following federal rules for providing patients with their medical records, a new "secret shopper" study in JAMA shows.

Researchers at Yale University Medical School faced obstacles when attempting to get patient records from 83 hospitals in 29 states that were named as among the nation's best by U.S. News & World Report.

The researchers were trying to determine if the hospitals were complying with federal Health Information Portability and Accountability Act mandates for accessing patient medical records.

Study senior author Harlan M. Krumholz, MD, a cardiologist and researcher at Yale University and Yale-New Haven Hospital, said the problem could be much worse nationwide because the "secret shopper" used to compile responses intentionally targeted well-resourced hospitals.

"This is going on at top hospitals that should be able to invest in these things," Krumholz says. "That's why we thought this was a good place to start, because this should be the best case scenario."

The study sought patient records two ways: using telephone calls, and filling out records request forms.

For the phone calls, a researcher reading from a script called the records departments at the hospitals over a three-month span last fall, asking for the entire medical record of a patient that included lab tests, medical history, physician exam results and discharge notes.

The researcher asked about if the cost and time it would take to obtain the records, and if the records could be picked up in person, mailed, emailed, faxed, placed on CDs or accessed through a patient portal.   

"There was discordance between information provided on authorization forms and that obtained from the simulated patient telephone calls in terms of requestable information, formats of release, and costs," the study said.

"On the forms, as few as nine hospitals (11%) provided the option of selecting one of the categories of information and only 44 hospitals (53%) provided patients the option to acquire the entire medical record," the researchers said. "On telephone calls, all 83 hospitals stated that they were able to release entire medical records to patients."

Even then, there were discrepancies in the information provided by hospital records keepers in telephone calls versus what the hospitals' records request forms said. For example, 83% of the hospital administrators said on the telephone that the patient records could be picked up in person, while only 48% of hospital records request forms said that was the case.

HIPAA requires that patient records be supplied in the format requested by the patient.

"For some places it's a strategy," Krumholz says. "One health system told me that they didn't have an interest in making it easy for people get the records because then people might go to the place across town. I actually heard someone say that!"

"But for most places it's not part of a strategic effort. It's more benign neglect," he says. "The people in the records room don't necessarily seem up to date with the regulations that were instituted a decade ago and they haven't configured a system that makes it easy for people."

There was no accounting for the prices hospitals charged to access the records. The study found that 48 hospitals charged well above the federal recommendation of $6.50 for electronically maintained records. In one instance, a hospital charged $541.50 for a 200-page record.

Krumholz says the study findings on fees are consistent with many complaints he's heard from acquaintances trying to access medical records.

"I know someone whose mother was in a top New York hospital and she said 'I need to take her records back with me,'" Krumholz said. "They brought out a big box and said 'We can give you all these records, but it will be $600.' She said 'I'm not paying that much,' and they said 'How about $300?'"

Krumholz says federal and state regulators haven’t enforced existing laws on accessing patient records, but that may change.

"CMS Administrator Seema Verma has had her own experience of having trouble getting the medical records for her husband, and she's talked about this," Krumholz says. "She's going to get CMS behind improving this situation, either through better incentives or stronger penalties."

"I am hoping that the hospitals, once they realize what's going on, will want to address this themselves."