The Patient Record Scorecard

A deep analysis showing how medical record providers comply with the HIPAA Right of Access based on patient requests.

Scorecard reflects responses to patient requests for access from 2/10/19 – 2/13/20. Scoring is ongoing.
Contact us about your institution’s score.

Health Institution

Score

Reported As Of

Non-HIPAA compliant

HIPAA compliant Substantial intervention

HIPAA compliant Minimal intervention

HIPAA compliant Seamless process

HIPAA compliant Patient focused

Atrium Health’s Carolinas Medical Center 1000 Blythe Blvd, Charlotte, NC

2/13/20

Auburn University Medical Clinic 400 Lem Morrison Drive, Auburn, AL

2/13/20

Banner – University Medical Center South 2800 E Ajo Way, Tucson, AZ

2/13/20

Banner Casa Grande Medical Center 1800 E Florence Blvd, Casa Grande, AZ

2/13/20

Banner Desert Medical Center 1400 S Dobson Road, Suite 101, Mesa, AZ

2/13/20

Banner Gateway Medical Center 1900 N Higley Rd, Gilbert, AZ

2/13/20

Banner Heart Hospital 6750 E Baywood Ave, Mesa, AZ

2/13/20

Banner University Medical Center Phoenix 1111 East McDowell Road, Phoenix, AZ

2/13/20

Baptist Clay Medical Center 1771 Baptist Clay Drive, Fleming Island, FL

2/13/20

Baptist Health of Miami 8900 North Kendall Drive, Miami, FL

2/13/20

Baptist Hospitals of Southeast Texas 3080 College Street, Beaumont, TX

2/13/20

Baptist Medical Center 800 Prudential Drive, Jacksonville, FL

2/13/20

Baptist Medical Center Jacksonville 800 Prudential Drive, Jacksonville, FL

2/13/20

Baptist Memorial Hospital 6019 Walnut Grove Road, Memphis, TN

2/13/20

Barnes Jewish Hospital and Siteman Cancer Center 1 Barnes Jewish Hospital Plaza, St. Louis, MO

2/13/20

Barnes-Jewish West County Hospital 12634 Olive Boulevard, Creve Couer, MO

2/13/20

Bay Area Hospital 1775 Thompson Rd, Coos Bay, OR

2/13/20

Baylor Scott & White Family Medicine 1110 Parker Square Road, Flower Mound, TX

2/13/20

Baylor Scott & White Hospitals and Clinics – ALL LOCATIONS 2401 S 31st St., Temple, TX

2/13/20

Baylor Scott & White The Heart Hospital – Denton 2801 S. Mayhill Road, Denton, TX

2/13/20

Bayshore Medical Center 4000 Spencer Hwy, Pasadena, TX

2/13/20

Beaumont Hospital, Grosse Pointe 468 Cadieux Rd, Grosse Pointe, MI

2/13/20

Beth Israel Deaconess Medical Center 330 Brookline Ave, Boston, MA

2/13/20

Beverly Hills Cancer Center 8900 Wilshire Boulevard, Suite 200, Beverly Hills, CA

2/13/20

Billings Clinic – All Locations 801 North 29th Street, Billings, MT

2/13/20

Bingham Memorial Hospital 98 Poplar St, Blackfoot, ID

2/13/20

Blue Sky Neurology – all locations 499 E. Hampden Avenue, Suite 360, Englewood, CO

2/13/20

Boone Hospital Center 1600 East Broadway, Columbia, MO

2/13/20

Borg Imaging 2263 South Clinton Avenue, Rochester, NY

2/13/20

Borland-Groover Clinic 4800 Belfort Road, Jacksonville, FL

2/13/20

Boston Children’s Hospital 300 Longwood Ave, Boston, MA

2/13/20

Boston Scientific Corporation 4100 Hamline Dr N, Arden Hills, MN

2/13/20

Bowden Eye Associates 7205 Bonneval Road, Jacksonville, FL

2/13/20

Bozeman Health Deaconess Hospital 915 Highland Blvd, Bozeman, MT

2/13/20

Brewton Medical Center 1121 Belleville Ave, Brewton, AL, Brewton, AL

2/13/20

Brigham and Women’s Hospital 75 Francis Street, Boston, MA

2/13/20

Bristol Regional Medical Center 1 Medical Park Boulevard, Bristol, TN

2/13/20

Brooklyn VA Medical Center 800 Poly Place, Brooklyn, NY

2/13/20

Broward Health Medical Center 1600 S Andrews Ave, Fort Lauderdale, FL

2/13/20

Broward Health North 201 E Sample Road, Deefield Beach, FL

2/13/20

Brown Physicians Patient Center University Medicine – Dr Robert Velasco 375 Wampanoag Trail #301, East Providence, RI

2/13/20

Brownwood Regional Medical Center 1501 Burnett Road, Brownwood, TX

2/13/20

Bryn Mawr Hospital 130 S Bryn Mawr Ave, Bryn Mawr, PA

2/13/20

California Proton 9730 Summers Ridge Road, San Diego, CA

2/13/20

CAMC Cancer Center 130 - 138 57th Street Building 3, Unit 2, Charleston, WV

2/13/20

Cancer Care Northwest – South Office 601 S Sherman Street, Spokane, WA

2/13/20

Cancer Center at Northwestern Medicine Lake Forest Hospital 1000 N. Westmoreland Road, Lake Forest, IL

2/13/20

Cancer Center of Sarasota-Manatee 3830 Bee Ridge Rd #301, Sarasota, FL

2/13/20

Cancer Specialists of North Florida 1375 Roberts Drive, Suite 103, Jacksonville Beach, FL

2/13/20

Cancer Treatment Centers of America, Atlanta 600 Celebrate Life Pkwy, Newnan, GA

2/13/20

The Patient Record Scorecard Methodology

The Patient Record Scorecard grades health care providers on how well they comply with a patient’s request, under the HIPAA Privacy Rule, to get copies of their medical records. Although there are a number of state laws that set a higher bar for patient access to records, only compliance with the HIPAA Privacy Rule was evaluated.

The score – between 1 to 5 stars – is based on the response of health care providers to one or more actual records requests submitted by patients (the patients request that their information be sent to their Ciitizen personal health record accounts). Ciitizen helps these patients by following up with each provider to make sure the patients’ requests get fulfilled.

The goal of the Patient Record Scorecard is to encourage and guide every health care provider to ultimately reach and maintain five stars.

How we reach the score

The star ratings are based on compliance with four key components of the HIPAA Right of Access:

Accepts requests by email or fax: Providers may not create a barrier to access by requiring patients to submit requests in person or by mail. (45 CFR 164.524(b)(1), https://www.hhs.gov/hipaa/for-professionals/faq/2036/can-an-individual-through-the-hipaa-right/index.html)

Sent in format requested: The provider sends the records in the format the patient requests, which is in digital – including by email – for text, CD for images. (45 CFR 164.524(c)(2)(ii)), https://www.hhs.gov/hipaa/for-professionals/faq/2060/do-individuals-have-the-right-under-hipaa-to-have/index.html.

Sent within 30 days*: The provider responds to the request within 30 days of receipt. (45 CFR 164.524(b)(2)(i))

*Providers can get credit for meeting the “within 30 days” component if within 30 days they provide a written statement of reasons for the delay and the date by which the records will be provided, and if the records are received within 60 days of receipt.

No unreasonable fees: Providers may only charge reasonable, cost-based (i.e., minimal) fees to cover labor costs of copying and supplies. (45 CFR 164.524(c)(4))

Star Ratings

One-Star - Non-HIPAA compliant​

Providers get one star for accepting an access request from a patient by fax or e-mail. This means the provider at least has a HIPAA-compliant process in place for accepting patient record requests (for example, the patient is not asked to mail in a request or make the request in person).

Two-Stars - HIPAA compliant Substantial intervention​

A provider earns two stars if they:

  • Meet all four of the HIPAA compliant components
  • Request had to be escalated more than once to a supervisor or the provider’s privacy official to ensure it was fulfilled in compliance with HIPAA. The need for intervention puts undue burden on the patient.

Three-Stars - HIPAA compliant with minimal intervention​

A provider earns three stars if they:

  • Meet all four of the HIPAA compliant components
  • Request required only one escalation to a supervisor or chief privacy officer to educate, and bring to their attention, that staff were not meeting HIPAA requirements.

Four-Stars - HIPAA compliant with seamless process​

A provider earns four stars if they:

  • Meet all of the HIPAA-compliant components
  • Request was processed seamlessly (i.e. without the need for any additional escalations to supervisors or privacy officials).

Five-Stars - HIPAA compliant and patient focused​

Providers who earn five stars go above and beyond to put patients first by doing the following:

  • Send records in five days or less
  • Accept external request forms (i.e., not requiring that patients use a specific form)
  • Provide patients their records for free

For those health care providers where more than one request was submitted, the score reflects the provider’s performance based on the most recent records request. The Scorecard will be revised every three to six months to include new entries and updated scores from existing providers.