I just re-read an email newsletter by Monica Oss of Open Minds asking the question: “Who Owns Patient Records?“. The answer to this question varies from state to state, with some locales not having clear statutory requirements. In Florida, the provider owns the record but must provide a copy of it if the patient requests it. In fact, the HIPAA privacy standards make it very clear that the provider is responsible for sharing records with a patient (making copies) if a patient so requests. One of the major exceptions to this requirement is psychotherapy notes, which the behavioral health provider is not responsible to share with the patient and must not share with anyone else (like an insurance company) without the patient’s specific permission.
This matter is complicated when a provider uses an Electronic Medical Record (EMR) that is hosted by a software company. Why should that matter, you ask. Well, in the case of the hosted product, the software resides on the company’s servers, not on the provider’s computer. The provider pays to use the software; they don’t own anything. Unless the provider prints everything out, they do not really have possession of a record; the software company does.
What happens when they decide to go to another software program? The first company may be willing to provide them with reports and printouts of their records, but getting that into a new program can be a challenge. And if the old company is willing to work with the new one to transfer the data, the process can be very time-consuming and costly…and some companies won’t even do it.
And if the EMR is free, the provider may be agreeing to share some of the data they enter so the software company can sell it to other companies…all within the confines of their role as a Business Associate, of course. You do have a BAA with the software company, right? And of course, you have a good contract that you have read and understood before you signed it, right?
Hmmm…..this ownership question is complicated.
Please share your comments below.