Rebooting Release of Information: Patient Portals are Changing ROI, but Analog Record Release is Still Necessary

By Mark Crawford

Patient portals are becoming commonplace in healthcare facilities, which have installed the technology to provide patients and physicians immediate online access to electronic medical records. Adoption of patient portals will continue to increase, driven in part by stage 2 “meaningful use” EHR Incentive Program quality measures that require providers to give patients quick, electronic, and online access to their medical information.

But as healthcare facilities begin to rely on portals to release and exchange health records, some HIM professionals wonder what the impact will be on in-house and outsourced hospital release of information (ROI) services that deliver both paper and electronic copies to patients, providers, and other involved third parties. While some ROI services may be shifted to the portal, HIM experts feel formal release of information services will still be necessary.

“The patient portal as required for meaningful use is for patient access only and most likely will be for limited information only,” says Colleen Goethals, MS, RHIA, FAHIMA, HIM consultant at Cardone EHR Solutions, a Rockford, IL-based provider of health record management services. “Release of information services, whether outsourced or in-sourced, include all requester types including attorneys, disability, insurance, continuing care, physicians, and audits.”

Portals Handle Portion of ROI Requests

ROI services handle a large volume of complex medical record requests that most portals couldn’t handle, according to Stephen Hynes, president of MRO Corporation, a King of Prussia, PA-based provider of disclosure management solutions, including electronic release of information services.

“Patient requests through portals are only a small portion of the overall disclosure volume,” Hynes says. “As patient requests migrate to portals, we will probably see a slight decrease in volume. It is likely that a full patient record will not be available via a portal, so some patients will still have to request their records the ‘old-fashioned’ way.

“Most patients only request a small part of their record anyway, such as a blood test.”

ROI staff hope patient portals will simplify the release of information process for patients, and enable providers to offer more efficient and timely delivery of requested health information. This will enable the patient to request records through the Internet or e-mail and have the request automatically directed to the appropriate location to process. ROI staff can then manage requests via the portal on a daily basis, just as they manage paper requests.

“Once the request is processed, there are options to send the records to the patient via e-mail or Internet within a secure account,” says Teresa Knox, RHIA, CHC, lead analyst for the HIM department at Mercy Hospital in Springfield, MO. “This is a patient satisfier, because they are receiving their information in a more timely fashion. Once they have the record in a PDF format, they can print it as many times as they need from their own location.”

This change from traditional ROI services will require more technology infrastructure and system upgrades. The downside, Knox notes, relates to patients who do not have basic computer skills or simply don’t want to access their data through a patient portal. In these cases the traditional paper-based ROI approach would be utilized.

To Release or Not to Release

The impact of patient portals on ROI services is in part dependent on the policies and procedures of the healthcare facility. There is no standardization among patient portal products for what information will or will not be made available. Therefore, the data a patient can access via the portal is dependent on a facility’s internal policies. For example, results that require a physician’s explanation or an appointment to discuss-such as lab tests or pathology results-may or may not be available through a patient portal. In these cases, the more traditional ROI request through the HIM department or its ROI vendor would be necessary.

“Patients with sensitive diagnoses that have additional laws and statutes, such as mental health, alcohol and drug abuse, AIDS and HIV, or development disabilities will need additional security,” Goethals says. “The facilities will need to address how they are going to address these special cases.”

Most facilities do not make a patient’s entire medical record available through the patient portal because of these possible restrictions. As a result, situations will sometimes arise when patients still need to request their records from the HIM department for additional pieces of information. Even in the case of providing a patient with a shortened summary or abstract of his or her medical record through a patient portal, it is likely that certain elements of the record may be withheld.

“Currently our portal is limited as to what medical records and other information are available to the patient,” says Anne Dixon, RHIA, manager of medical information services for Vanderbilt University Medical Center, based in Franklin, TN. “There are also limitations on how many delegates a patient can assign to have access to their portal account.

“More information will be available over time to the patient through the portal, but there is not complete open access currently.”

Duration of Access Limited

Since the first installation of patient portals, HIM professionals have debated just how long patients should have access to their medical information through the portal, and whether that access should expire after so many views or a certain length of time.

“It could be argued that the patient would want to be able to access their data as long as it is required to be retained or available in accordance with state law retention requirements,” says Tina Qualls, RHIT, CHC/CHPC, privacy officer and director of ethics and compliance for LifePoint Hospitals, based in Nashville, TN.

Mercy Hospital’s ROI vendor sets a maximum timeframe of 365 days for how long patient records can be stored on the server before expiring. This is also the maximum amount of time the portal can stay open for patients to access their records. Knox recommended that access to the portal should only be available to a patient for 30 days after their records are placed on the secure portal for retrieval.

Other systems, such as Vanderbilt University Medical Center, allow patients lifelong access to their portal information.Duration of access is currently a facility decision that should be made according to the patient portal goals the facility is trying to achieve.

“Keep in mind that patient portals are not designed to help patients get copies of records for ROI purposes,” Hynes says. “Patient portals are being implemented to help patients get more engaged in their healthcare. The focus of many portals will be to show lab and test results, schedule follow-up care, and review discharge instructions.”

Due to the limited amount of time medical records are stored on many portals, formal ROI processes are still the best option for patients trying to collect all their records regardless of the timing.

“If the intent is short-term only, it defeats the purpose of being able to access this information at any time,” Goethals says. “A patient may not need or want the information within, say, 90 days of service. Therefore, a patient who wants information [after the] time limit has expired will have to follow the traditional ROI process or some variation.”

How the patient accesses information may also determine the time limit. “If information is pushed to a mobile device and not a portal, then it should expire upon viewing and within a limited number of hours or days,” Qualls adds.

Charges and Fees To Be Determined

The healthcare industry is waiting for guidance from the federal government-through the HITECH Act Omnibus HIPAA privacy final rule-regarding how much providers can charge for electronic copies of records. Even though patient portals require no paper copy to print and deliver, time and resources are still invested in converting an EHR-based record into a document that is easy for patients to read and understand. While access to most patient portals is free to the patient, the maintenance of even a portal’s limited information does come with labor and technology costs to the facility. Healthcare facilities and vendors can continue to charge for electronic access through portals.

“ROI fees are not solely based on producing records,” Hynes says. “There is a large compliance and administrative burden created by ROI requests. At the end of the day, someone still has to manage the hospital’s disclosure process.”

ROI fees are required in about 42 states, and vary from “below cost to above actual cost,” Hynes says. “Most of the cost deals with managing the request and wrapping customer service around it,” he says. “Processing a patient request is much different than a more typical request from an attorney or a payer.”

Hospitals should be able to charge for providing copies of personal health information on electronic media such as CDs, DVDs, and USB drives, Qualls says. “Like paper and toner, a CD or DVD or flash drive still costs the hospital money to purchase,” she says. “It is still a medium that has to be accounted for cost-wise. Also it is not really safe for hospitals to accept foreign media from a patient, for example, because this media could contain viruses or otherwise subject the hospital system to security vulnerabilities.”

Qualls notes that traditional ROI vendors have not been in the business of providing discharge instructions and continuity of care documents (CCDs)-two pieces of information the meaningful use program calls for providers to make available to patients. Patients generally received these pieces of information in paper form directly from their provider, meaning the switch to electronic requests doesn’t change the involvement of an ROI company.

“I think the current interpretation is that providers are required to ensure a certain percentage of patients can retrieve or receive their healthcare information electronically. Therefore, sending electronic discharge instructions or continuity of care documents (CCDs) would probably not incur a charge,” Qualls says. “However, charges will probably still be allowed for providing documents not required by meaningful use criteria. 

“This will be complicated and require detailed policies and procedures between HIM and the ROI vendor.”

Vanderbilt University Medical Center does not charge patients for copies of the first 50 pages of their medical records if the patient walks into the department to request copies. Its ROI vendor does charge the patient if copies of their records are mailed, and will charge third parties (i.e., attorneys, insurance companies) for copies.

At Mercy Hospital, patients are not charged for the first request for their records for a specific encounter, regardless of whether they receive it through a portal or paper delivery. “If they ask for a second copy for the same encounter, there is a fee prior to pick up or delivery,” Knox says. “There is a set fee of $25 for electronic record delivery regardless of how large the record file.

“I believe the industry’s vendors will face a challenging time charging for records delivered electronically as this increasingly becomes the expected format for doing ROI business and has been mandated by meaningful use to make it available.”

States are also getting involved in regulating ROI fees. For example, in 2007 the state of Illinois passed a law that said if health information is released in an electronic format, the facility can only charge 50 percent of the rate they would charge for providing the record in paper. “Therefore, as we move forward with electronic access, all requesters are subject to this statute,” Goethals says. “However, I am not aware of patients being charged for the information available via the patient portals. Technically, however, under the law in many states, a fee could be charged.”

Formal ROI Still Necessary

Patient requests are only a small percentage of record requests, and ROI services provide a much broader value proposition to the healthcare entity than just copying records, according to Hynes. “Formal ROI services involve a somewhat complicated workflow process to properly receive, validate, aggregate, quality check, release, and track each request,” he says.

ROI vendors will still be needed to fulfill requests for paper records that were produced prior to the implementation of the EHR and not yet scanned into the system. They are also needed to provide ROI services to entities or providers that choose not to adopt EHRs or patient portals.

“ROI services reach out to a wider group of people than just patients, including insurance companies, attorneys, DDS, and other government services,” Dixon says. “Courts will still want certified copies of the entire medical record. Anyone who needs all records, including nursing notes, orders, and medication administration records, will still need to request the records through ROI.”

There is also a significant part of the population that does not use computers-and they still have a right to their records, Knox says. An ROI vendor or hospital department would need to provide these people records in a format they can access and utilize.

“The formal ROI service does provide the personal touch of talking to a person on the phone or in person,” Knox said. “There is a certain group of patients that prefers this type of service and relies on it often. By law we are required to furnish patients with their records in any format they request.”

Goethals emphasizes that ROI cannot just be summed up to a “push of a button” in a patient portal. “There are many steps involved in the process of releasing information to requesters such as attorneys, insurance companies, disability, etc.,” she says. “Verifying proper authorization, checking for sensitive information, and providing quality checks, among other steps, must be performed by someone-whether it is an in-house employee or a vendor.”

Vanderbilt University Medical Center officials attest to the strong value of ROI services, despite the growing use of patient portals. “Our ROI [department] still processes over 10,000 requests for release of information a month, even though we have a very active patient portal with over 100,000 current users,” Dixon says. “The number of our ROI requests has continued to increase, even as the number of portal users continues to expand.”

Future Portals May Impact ROI Structure

Patient portals have encouraged facilities and vendors to work together to develop new creative ways to share information electronically, and make that information more easily available to patients. Facilities are now educating patients about the various options they have for accessing their medical records electronically. More hospitals are building patient portals that allow patients immediate access to portions of their records regarding test results and prescription refills, as well as enabling patients the ability to ask their physicians questions regarding their healthcare through secure messaging.

As patient portals continue to grow in popularity, as well as technological sophistication, they will allow ROI vendors and departments to rearrange staff or consolidate resources to be more efficient. This will also be dependent to some degree on stage 2 meaningful use and beyond, and the initiative’s success in driving patient engagement through portals.

Fewer ROI staff may be needed as hospitals move to patient portals since fewer paper records will need to be retrieved. This, of course, also assumes the hospitals will move toward more advanced EHR systems. There will be less need to invest time and resources in scanning personal health information if it is already available through the EHR and on the portal.

“As more robust EHR solutions are adopted, formal ROI services will not need to collect information and scan it as they do in today’s mostly paper world,” Qualls says. “Portals should enable ROI companies to have faster, more efficient access, assuming there are features that allow ROI companies to utilize and push ROI requests through the existing portal.” 

There are several ways a portal can improve the overall ROI process and make it more efficient, Qualls says. “Some systems may choose not to place information in a patient-accessible portal unless it is requested by an authorized requestor or the patient,” Qualls says. “If this is the case then traditional ROI processes will still be valuable.”

For Dixon, the challenge is keeping the portal updated and fresh-especially trying to compete for the limited resources every facility has for a long list of improvements and enhancements.

“Technology constantly changes,” she said. “We are looking at creating a solution for one issue that will last only two years. In another two years a more global solution will be implemented.”

As portals and mobile health technology advance, patients will have easier access to their health information. Healthcare facilities will also have the job of educating patients on their access options. This new challenge will take time, Dixon says.

“We want to develop new ways to remind patients to take medications, read educational tracks about managing their diseases, and send them reminders for upcoming appointments,” she says. “We think we can reach a greater population on a mobile device rather than a personal computer-but we also have to ask ourselves, what is the tipping point for engaging the patient without being a nuisance?”

Mark Crawford ( is a freelance writer based in Madison, WI.

Article citation:
Crawford, Mark. "Rebooting Release of Information: Patient Portals are Changing ROI, but Analog Record Release is Still Necessary " Journal of AHIMA 84, no.2 (February 2013): 22-26.