§ 78B-5-618 — Patient access to medical records -- Third-party access to medical records -- Medical records services -- Fees -- Standard form.

(1) As used in this section:
(1)(a) "Force majeure event" means an event or circumstance beyond the control of the health care provider or the health care provider's third-party service, including fires, floods, earthquakes, acts of God, lockouts, ransomware, or strikes.
(1)(b) "Health care provider" means the same as that term is defined in Section 78B-3-403.
(1)(c) "History of poor payment" means three or more invoices where payment is more than 30 days late within a 12-month period.
(1)(d) "Indigent individual" means an individual whose household income is at or below 100% of the federal poverty level as defined in Section 26B-3-113.
(1)(e) "Inflation" means the unadjusted Consumer Price Index, as published by the Bureau of Labor Statistics of the United States Department of Labor, that measures the average changes in prices of goods and services purchased by urban wage earners and clerical workers.
(1)(f) "Payment and balance information" means:
(1)(f)(i) all payments the health care provider has received for providing health care to the patient; and
(1)(f)(ii) the total balance owed to the health care provider for providing the health care to the patient.
(1)(g) "Qualified claim or appeal" means a claim or appeal under any:
(1)(g)(i) provision of the Social Security Act as defined in Section 67-11-2; or
(1)(g)(ii) federal or state financial needs-based benefit program.
(1)(h) "Third-party service" means a service that has entered into a contract with a health care provider to provide patient records on behalf of a health care provider.
(2) Pursuant to Standards for Privacy of Individually Identifiable Health Information, 45 C.F.R., Parts 160 and 164, a patient or a patient's personal representative may inspect or receive a copy of the patient's records from a health care provider when that health care provider is governed by the provisions of 45 C.F.R., Parts 160 and 164.
(3) When a health care provider is not governed by Standards for Privacy of Individually Identifiable Health Information, 45 C.F.R., Parts 160 and 164, a patient or a patient's personal representative may inspect or receive a copy of the patient's records unless access to the records is restricted by law or judicial order.
(4) A health care provider who provides a paper or electronic copy of a patient's records to the patient or the patient's personal representative:
(4)(a) shall provide the copy within the deadlines required by the Health Insurance Portability and Accountability Act of 1996, Administrative Simplification rule, 45 C.F.R. Sec. 164.524(b); and
(4)(b) may charge a reasonable cost-based fee provided that the fee includes only the cost of:
(4)(b)(i) copying, including the cost of supplies for and labor of copying; and
(4)(b)(ii) postage, when the patient or patient's personal representative has requested the copy be mailed.
(5) (5)(a) Except for records provided under Section 26B-8-411, a health care provider or a health care provider's third-party service that provides a copy of a patient's records to a patient's attorney, legal representative, or other third party authorized to receive records:
(5)(a)(i) shall provide the copy within 30 days after receipt of notice;
(5)(a)(ii) may charge a reasonable fee for paper or electronic copies, but may not exceed the following rates:
(5)(a)(ii)(A) $30 per request for locating a patient's records;
(5)(a)(ii)(B) reproduction charges may not exceed 53 cents per page for the first 40 pages and 32 cents per page for each additional page;
(5)(a)(ii)(C) the cost of postage when the requester has requested the copy be mailed;
(5)(a)(ii)(D) if requested, the person fulfilling the request will certify the record as a duplicate of the original for a fee of $20; and
(5)(a)(ii)(E) any sales tax owed under Title 59, Chapter 12, Sales and Use Tax Act; and
(5)(a)(iii) may charge an expedition fee of $20 if:
(5)(a)(iii)(A) the requester's notice explicitly requests an expedited response; and
(5)(a)(iii)(B) the person fulfilling the request postmarks or otherwise makes the record available electronically within 15 days from the day the person fulfilling the request receives notice of the request.
(5)(b) Notwithstanding the provisions of Subsection (5)(a)(ii) and subject to Subsection (5)(c), in the event the requested records are not postmarked or otherwise made available electronically by the person fulfilling the request:
(5)(b)(i) within 30 days after the day on which notice is received by the person fulfilling the request, the person fulfilling the request shall waive 50% of the fee; or
(5)(b)(ii) within 60 days after the day on which notice is received by the person fulfilling the request, the person fulfilling the request shall provide the requested records free of charge to the requester.
(5)(c) Performance under Subsection (5)(b) shall be extended in accordance with Subsection (5)(d) if the person fulfilling the request notifies the requester of:
(5)(c)(i) the occurrence of a force majeure event within 10 days from the day:
(5)(c)(i)(A) the force majeure event occurs; or
(5)(c)(i)(B) the person fulfilling the request receives notice of the request; and
(5)(c)(ii) the termination of the force majeure event within 10 days from the day the force majeure event terminates.
(5)(d) In accordance with Subsection (5)(c), for a force majeure event:
(5)(d)(i) that lasts less than eight days, the person fulfilling the request shall, if the records are not postmarked or otherwise made available electronically within:
(5)(d)(i)(A) 30 days of the day the force majeure event ends, waive 50% of the fee for providing the records; and
(5)(d)(i)(B) 60 days of the day the force majeure event ends, waive the entire fee for providing the records;
(5)(d)(ii) that lasts at least eight days but less than 30 days, the person fulfilling the request shall, if the records are not postmarked or otherwise made available electronically within:
(5)(d)(ii)(A) 60 days of the day the force majeure event ends, waive 50% of the fee for providing the records; and
(5)(d)(ii)(B) 90 days of the day the force majeure event ends, waive the entire fee for providing the records; and
(5)(d)(iii) that lasts more than 30 days, the person fulfilling the request shall, if the records are not postmarked or otherwise made available electronically within:
(5)(d)(iii)(A) 90 days of the day the force majeure event ends, waive 50% of the fee for providing the records; and
(5)(d)(iii)(B) 120 days of the day the force majeure event ends, waive the entire fee for providing the records.
(5)(e) (5)(e)(i) A third-party service may require prepayment before sending records for a request under this Subsection (5) if the third-party service:
(5)(e)(i)(A) determines the requester has a history of poor payment; and
(5)(e)(i)(B) notifies the requester, within the time periods described in Subsections (5)(b)(i) and (ii), that the records will be sent as soon as the request has been prepaid.
(5)(e)(ii) The fee reductions described in Subsection (5)(d) do not apply if a third-party service complies with Subsection (5)(e)(i).
(5)(f) If a third-party service does not possess or have access to the data necessary to fulfill a request, the third-party service shall notify:
(5)(f)(i) the requester that the request cannot be fulfilled; and
(5)(f)(ii) state the reasons for the third-party service's inability to fulfill the request within 30 days from the day on which the request is received by the third-party service.
(5)(g) A patient's attorney, legal representative, or other third party authorized to receive records may request patient records directly from a third-party service.
(6) (6)(a) A separate notice of request for payment and balance information shall:
(6)(a)(i) clearly indicate that the request is only for payment and balance information; and
(6)(a)(ii) indicate the name, telephone number, email address, and address of the requester.
(6)(b) A health care provider or third-party service fulfilling a request for payment and balance information from a patient's attorney, legal representative, or other third-party representative, shall fulfill the request within 30 days after the day on which notice is received by the health care provider or by the third-party service, whichever is fulfilling the request, by:
(6)(b)(i) mailing a postmarked copy of the information to the requester; or
(6)(b)(ii) providing the information electronically or telephonically.
(6)(c) A health care provider or third-party service that is responsible for fulfilling a request for payment and balance information but fails to:
(6)(c)(i) fulfill the request within 30 days, in accordance with Subsection (6)(b), shall pay, as a penalty, $50; and
(6)(c)(ii) fulfill the request within 60 days shall pay, as a penalty, an additional $150.
(6)(d) A health care provider or third-party service obligated to pay a penalty under Subsection (6)(c) shall pay the amount owed:
(6)(d)(i) to reduce any amount the patient owes to the health care provider for the provision of health care, after any third-party obligations to pay, if the amount owed is more than the penalty;
(6)(d)(ii) directly to the patient, if the requested payment and balance information reflects that the patient owes no amount to the health care provider for the provision of health care services; or
(6)(d)(iii) allocated between:
(6)(d)(iii)(A) a payment to satisfy the amount the patient owes to the health care provider for the provision of health care, as indicated on the payment and balance information; and
(6)(d)(iii)(B) a payment in the amount of any remaining penalty obligation to the patient.
(6)(e) A third-party service may satisfy any obligation to pay a penalty under Subsection (6)(c) by remitting the penalty amount to the health care provider to be allocated in accordance with Subsection (6)(d).
(7) A health care provider or third-party service shall, if the health care provider or the third-party service responding to a request for payment and balance information is unable to comply with Subsection (6)(b), provide a written response that includes:
(7)(a) contact information, if known, for the individual who the requester may contact to fulfill the request; and
(7)(b) the reason for not complying with Subsection (6)(b).
(8) (8)(a) Subject to Subsection (8)(b), a health care provider that contracts with a third-party service to fulfill the health care provider's medical record requests shall file a statement with the Division of Professional Licensing containing:
(8)(a)(i) the name of the third-party service;
(8)(a)(ii) the phone number of the third-party service;
(8)(a)(iii) the fax number, email address, website portal address, if applicable, and mailing address for the third-party service where medical record requests can be sent for fulfillment; and
(8)(a)(iv) beginning January 1, 2025, whether the third-party service is authorized to fulfill requests for patient medical records for patient payment and balance information.
(8)(b) If an individual health care provider is an employee or contractor of an organization that is a health care provider and that contracts with a third-party service to fulfill the medical record requests for the individual health care provider, the organization may file the statement under Subsection (8)(a) on behalf of the organization's employees and contractors.
(8)(c) A health care provider described in Subsection (8)(a) shall update the filing described in Subsection (8)(a) as necessary to ensure that the information is accurate.
(8)(d) The Division of Professional Licensing shall develop a form for a health care provider to complete that provides the information required by Subsection (8)(a).
(8)(e) The Division of Professional Licensing shall:
(8)(e)(i) maintain an index of statements described in Subsection (8)(a) arranged alphabetically by entity; and
(8)(e)(ii) make the index available to the public electronically on the Division of Professional Licensing's website.
(9) A health care provider or the health care provider's third-party service shall deliver the medical records in the electronic medium customarily used by the person fulfilling the request or in a universally readable image such as portable document format:
(9)(a) if the patient, patient's personal representative, or a third party authorized to receive the records requests the records be delivered in an electronic medium; and
(9)(b) the original medical record is readily producible in an electronic medium.
(10) (10)(a) Except as provided in Subsections (10)(b) through (d), the per page fee in Subsections (4) and (5) applies to medical records reproduced electronically or on paper.
(10)(b) The per page fee for producing a copy of records in an electronic medium shall be 50% of the per page fee otherwise provided in this section, regardless of whether the original medical records are stored in electronic format.
(10)(c) (10)(c)(i) A health care provider or a health care provider's third-party service shall deliver the medical records in the electronic medium customarily used by the health care provider or the health care provider's third-party service or in a universally readable image, such as portable document format, if the patient, patient's personal representative, patient's attorney, legal representative, or a third party authorized to receive the records, requests the records be delivered in an electronic medium.
(10)(c)(ii) A person fulfilling the request under Subsection (10)(c)(i):
(10)(c)(ii)(A) shall provide the requested information within 30 days; and
(10)(c)(ii)(B) may not charge a fee for the electronic copy that exceeds $150 regardless of the number of pages and regardless of whether the original medical records are stored in electronic format.
(10)(d) Subject to Subsection (10)(e), in the event the requested records under Subsection (10)(c)(i) are not postmarked or otherwise made available electronically by the person fulfilling the request:
(10)(d)(i) within 30 days after the day notice is received by the person fulfilling the request, the person fulfilling the request may not charge a fee for the electronic copy that exceeds $75 regardless of the number of pages and regardless of whether the original medical records are stored in electronic format; or
(10)(d)(ii) within 60 days after the day notice is received by the person fulfilling the request, the person fulfilling the request shall provide the requested records free of charge to the requester.
(10)(e) Performance under Subsection (10)(d) shall be extended in accordance with Subsection (10)(f) if the person fulfilling the request notifies the requester of:
(10)(e)(i) the occurrence of a force majeure event within 10 days from the day:
(10)(e)(i)(A) the force majeure event occurs; or
(10)(e)(i)(B) the person fulfilling the request receives notice of the request; and
(10)(e)(ii) the termination of the force majeure event within 10 days from the day the force majeure event terminates.
(10)(f) In accordance with Subsection (10)(e), for a force majeure event:
(10)(f)(i) that lasts less than eight days, the person fulfilling the request, if the records are not postmarked or otherwise made available electronically within:
(10)(f)(i)(A) 30 days of the day the force majeure event ends, may not charge a fee for an electronic copy that exceeds $75 regardless of the number of pages and regardless of whether the original medical records are stored in electronic format; and
(10)(f)(i)(B) 60 days of the day the force majeure event ends, shall waive the entire fee for providing the records;
(10)(f)(ii) that lasts at least eight days but less than 30 days, the person fulfilling the request, if the records are not postmarked or otherwise made available electronically within:
(10)(f)(ii)(A) 60 days of the day the force majeure event ends, may not charge a fee for an electronic copy that exceeds $75 regardless of the number of pages and regardless of whether the original medical records are stored in electronic format; and
(10)(f)(ii)(B) 90 days of the day the force majeure event ends, shall waive the entire fee for providing the records; and
(10)(f)(iii) that lasts more than 30 days, the person fulfilling the request, if the records are not postmarked or otherwise made available electronically within:
(10)(f)(iii)(A) 90 days of the day the force majeure event ends, may not charge a fee for an electronic copy that exceeds $75 regardless of the number of pages and regardless of whether the original medical records are stored in electronic format; and
(10)(f)(iii)(B) 120 days of the day the force majeure event ends, shall waive the entire fee for providing the records.
(11) (11)(a) On January 1 of each year, the state treasurer shall adjust the following fees for inflation:
(11)(a)(i) the fee for providing patient's records under Subsections (5)(a)(ii)(A) and (B); and
(11)(a)(ii) the maximum amount that may be charged for an electronic copy under Subsection (10)(c)(ii)(B).
(11)(b) On or before January 30 of each year, the state treasurer shall:
(11)(b)(i) certify the inflation-adjusted fees and maximum amounts calculated under this section; and
(11)(b)(ii) notify the Administrative Office of the Courts of the information described in Subsection (11)(b)(i) for posting on the court's website.
(12) Notwithstanding Subsections (4) through (8), if a request for a medical record is accompanied by documentation of a qualified claim or appeal, a health care provider or the health care provider's third-party service:
(12)(a) may not charge a fee for the first copy of the record for each date of service that is necessary to support the qualified claim or appeal in each calendar year;
(12)(b) for a second or subsequent copy in a calendar year of a date of service that is necessary to support the qualified claim or appeal, may charge a reasonable fee that may not:
(12)(b)(i) exceed 60 cents per page for paper photocopies;
(12)(b)(ii) exceed a reasonable cost for copies of X-ray photographs and other health care records produced by similar processes;
(12)(b)(iii) include an administrative fee or additional service fee related to the production of the medical record; or
(12)(b)(iv) exceed the fee provisions for an electronic copy under Subsection (10)(c); and
(12)(c) shall provide the health record within 30 days after the day on which the request is received by the health care provider.
(13) (13)(a) Except as otherwise provided in Subsections (4) through (8), a health care provider or the health care provider's third-party service shall waive all fees under this section for an indigent individual.
(13)(b) A health care provider or the health care provider's third-party service may require the indigent individual or the indigent individual's authorized representative to provide proof that the individual is an indigent individual by executing an affidavit.
(13)(c) (13)(c)(i) An indigent individual that receives copies of a medical record at no charge under this Subsection (13) is limited to one copy for each date of service for each health care provider, or the health care provider's third-party service, in each calendar year.
(13)(c)(ii) Any request for additional copies in addition to the one copy allowed under Subsection (13)(c) is subject to the fee provisions described in Subsection (12).
(14) By January 1, 2023, a health care provider and all of the health care provider's contracted third party health related services shall accept a properly executed form described in Section 26B-8-514.

Legislative History

Amended by Chapter 277, 2025 General Session