Part 3: The Case for Better Health History Records – Identifying Barriers to Access

In Part 2 of this series, the focus was on ensuring adequate information to support subject eligibility. Knowing how many and what kinds of records to review is key to developing a robust review program to ensure subject eligibility, as is knowing how to reconcile record discrepancies and document the review. But, getting the records needed is sometimes a Herculean task. Thus, defining the common barriers to records acquisition is the focus of the third part of this blog series on medical histories.

In defining the barriers to access to historical medical records, it is important to first recognize that some potential study subjects will come with no obstacles to medical history availability, while other may present a combination of issues which must be tackled.

Obstacles in accessing medical records

Having flexibility in dealing with each situation is a must, and should be based upon clear identification of each issue at play. The most common barriers found during audits include:

• Subject refusal to provide permission for access;
• Charges implemented by record holders;
• Incomplete records;
• Document retention periods and locations;
• Education of staff members in charge of records release;
• Formatting of provided records, and;
• Time to procurement.

Although many of these barriers are self-explanatory, some deserve clarification as to how they appear and how they affect clinical research.

In the age of electronic medical records (EMRs), patient portals, and healthcare insurance web sites with medical claims information available at the touch of the button, it seems a little incongruous that many patients and physicians still struggle to get historical medical records.  One of the bigger factors for patients seeking records is cost, which can vary widely between health care providers, and may even be passed on to requesting physician offices.

Charging patients for records

In the United States, under the Health Insurance Portability and Accountability Act (HIPAA) of 1996, patients can be charged for records. Although the US Department of Health and Human Services recommends a charge of only $6.50 for an entire record, requires that charges be “reasonable”, and has provided new regulations forbidding page-by-page fees, many healthcare providers charge well in excess of the recommended amount – sometimes into the hundreds of dollars.

These charges, which can be prohibitive for many patients, are considered to be the “administrative” costs of collecting, collating, copying, and otherwise handling medical records, many of which may still be in paper format.

In contrast, under GDPR, providers cannot routinely charge for records. However, if they have already been provided once, administrative or communication fees can be applied.

In Canada, on the other hand, regulations around charges for and availability of medical records vary due to differing territorial and provincial privacy laws, which should be consulted to determine allowed charges that patients may face.

Putting pen to paper  

A common hurdle, whether you’re a patient or a health care provider, is the ability to get a complete medical record. Several factors contribute to this issue, including the fact that some records are handwritten on paper while others are electronic, there is often a lack of integration of test results and documents from other facilities or providers, physician retirement or death results in record ownership and storage changes, and there can even be a refusal of some health care providers to supply complete medical records.

As the medical care industry in the US has been forced to begin using EMRs, the dependency on paper medical records has fallen sharply and will continue to do so, but this has not entirely been alleviated and records more than 5-10 years old may well be paper or on a disparate system.

The same is also true globally as many countries are investing heavily in electronic systems, while remote areas and poor regions continue to rely on pen and paper. Getting these paper records from one medical provider to another can prove daunting, depending upon the size of the records and copying or transmission capabilities. Since patients may be treated at multiple facilities, just finding out who to ask for records can complicate matters significantly, as most providers do not integrate records from specialists, laboratories, diagnostic centers, or hospitals directly into their own files to create a single repository for each patient.

Although some large health care systems do integrate records, they are also often only the records from providers and affiliates within their own system, and are usually only the electronic documents. The potential outcome, then, is study staff spending hours requesting and gathering the records needed, and putting them into a single format for clinical research.

Hospitals not releasing full records

All this assumes that other medical providers will share complete medical records. While HIPAA guarantees access to complete medical records with some exceptions (i.e., mental health records, substance abuse treatment, etc.), a Yale study performed in 2018 clearly showed that only 53% of US-based hospitals “provided patients the option to acquire the entire medical record.”  Physician offices, pharmacies, medical clinics, and health insurers, all of whom fall under the auspices of HIPAA and from whom records may be needed, should not be expected to fare much better.

Under GDPR, the outlook is improved, as health care providers are required to share the entire medical record with few exceptions (i.e., if the record discloses information harmful to a third party, is privileged, or is under court order) unless they can offer a reasonable explanation for not doing so. Even then, if the patient does not agree with the reasoning, she has the right to bring the issue to the Information Commissioner’s Office (ICO) for review. Thus, under GDPR, health care providers may be expected to only refuse handover of exceptionally old records which are truly difficult to gather.

Third-party sharing of medical histories

Finally, the clinical researcher faces an additional barrier of staff at other healthcare provider facilities not recognizing that medical records can be provided to a third-party patient representative, or even other physicians.

Moreover, if they do provide the records, it is not always assured that the document format will be acceptable, as photocopies or faxes may be unreadable or the electronic program used to create the records may be incompatible with other systems.

Indeed, EMR compatibility has been a major obstacle since before 2013; and even given the recent move to create compatible electronic communication systems, the transfer of patient data across software systems can be accompanied with steep software developer charges that only large healthcare systems can absorb.

Importantly, both HIPAA and GDPR require that the patient receive medical records in their chosen format, but in the US this requirement is often not well-heeded. In Europe, GDPR is not old enough to provide full insight as to whether the provision will be adequately met in the near term as many providers are still in the educational stages of awareness.

Add to all of this the fact that HIPAA allows 30 days for fulfillment of a records request, and GDPR allows 30 days for an answer as to whether the request will be met, and it’s obvious that collecting medical records at all can become a headache.

Going back to the previous installments of this series, it should be clear that there are serious risks involved if medical records are not adequately gathered and reviewed for study subject eligibility. These risks from the site, contract research organization (CRO), and sponsor level should not be taken lightly.

With that in mind, solutions to the barriers to medical record accession will be the topic of Part 4.

by Barbara Rusin

About the author

Barbara A. Rusin is Regulatory Compliance Manager at MMS, providing technical oversight and direction to a global regulatory team, spread across four continents. Prior to MMS, Barbara was a Bioresearch Monitoring Investigator and Biologics Specialist with the Food and Drug Administration’s (FDA) Detroit District office. Connect with Barbara on LinkedIn here.