I want to change EMR vendors, but the current company is holding me up for big fees. How is this legal, since the patient is one who really owns the records? I couldn’t hang onto records to force a patient to pay their bill, so how can the EMR company do this with me?
EMR vendors are considered business associates under HIPAA and so are required to be in compliance with HIPAA, including as to records access. However, there is no private right of action under HIPAA, and so the doctor cannot sue them for not complying with the law.
All that the doctor can do is report them to the OCR, but the doctor is going to hit a significant obstacle because of the OCR’s own handling of the situation.
It starts off well:
“Generally, if a business associate blocks access to the PHI it maintains on behalf of a covered entity, including terminating access privileges of the covered entity, the business associate has engaged in an act that is an impermissible use under the Privacy Rule. For example, a business associate blocking access by a covered entity to PHI (such as where an EHR developer activates a “kill switch” embedded in its software that renders the data inaccessible to its provider client) to resolve a payment dispute with the covered entity is an impermissible use of PHI. Similarly, in the event of termination of the agreement by either party, a business associate must return PHI as provided for by the business associate agreement. If a business associate fails to do so, it has impermissibly used PHI.”
However, the OCR also states that a covered entity is responsible for ensuring the availability of PHI:
“To the extent that a covered entity has agreed to terms in a business associate agreement that prevent the covered entity from ensuring the availability of its own PHI, whether in paper or electronic form, the covered entity is not in compliance.”
The doctor who makes a complaint about the vendor holding the records hostage can be slammed for having, as the custodian of the records, agreed to terms that let the vendor do that.
