Attestation Requirements for Timely Access to Patient Records

Attestation Requirements: 


  • DENOMINATOR: Number of unique patients seen by the Eligible Physician (EP) or other eligible professional during the EHR reporting period.
  • NUMERATOR: Number of patients in the denominator who have timely (available to the patient within four business days of being updated in the certified EHR technology) electronic access to their health information online.
  • EXCLUSION: If an EP neither orders nor creates lab tests or information that would be contained in the problem list, medication list, medication allergy list (or other information as listed at 45 CFR 170.304(g)) during the EHR reporting period, they would be excluded from this requirement. EPs must select NO next to the appropriate exclusion, then click the APPLY button in order to attest to the exclusion.  

The resulting percentage (Numerator ÷ Denominator) must be at least 10 percent in order for an EP to meet this measure.



 Additional Information:  

  • Online electronic access through either a patient portal or personal health record (PHR) will satisfy the measure of this objective.
  • An EP may decide that electronic access to a portal or PHR is not the best forum to communicate results. Within the confines of laws governing patient access to their medical records, we would defer to EP’s judgment as to whether to hold information back in anticipation of an actual encounter between the provider and the patient.
  • Information that must be provided electronically is limited to that information that exists electronically in or is accessible from the certified EHR technology and is maintained by or on behalf of the EP. At a minimum, certified EHR technology makes available lab test results, problem list, medication list, and medication allergy list.
  • An EP may withhold information from the electronic copy of a patient’s health information in accordance with the HIPAA Privacy Rule, as specified at 45 CFR 164.524.
  • The objective and measure focus on the availability of access and the timeliness of data, not utilization. The EP is not responsible for ensuring that 10 percent request access or have the means to access, only that 10 percent of all unique patients seen by the EP could access the information if they so desired.