HIPAA $6.50 Copy Fee Limitation Does Not Apply to Lawyers and Other Third Party Record Requests
Does the Patient Rate (i.e., the “reasonable cost based fee”—typically $6.50) apply to an individual’s request to transmit medical records to a third party? In CIOX Health, LLC v. Alex Azar, et al, the United States District Court addressed this and other issues in the production of medical records.
On the $6.50 issue, the Court’s answer is “no”…at least for now. The CIOX Health court declared unlawful and vacated HHS guidance which expanded the Patient Rate to an individual’s request to transmit medical records to a third party.
The Health Insurance Portability and Accountability Act (“HIPAA”), and the United States Department of Health and Human Services’ (“HHS”) subsequent promulgation of the Privacy Rule in 2000, established an individual’s right to access their own protected health information (“PHI”) at a reasonable, cost based fee (the “Patient Rate”). CIOX Health, like everyone else in the industry, understood that the Patient Rate applied only when providing an individual their own medical records for their own use and not when providing the individual’s PHI to third parties, such as law firms or health insurance companies. For records transmitted to third parties, the Patient Rate did not apply, and health care providers and their release of information contractors, generally charged the fees authorized by state law, often hundreds of dollars more than the Patient Rate.
This once clear picture has become confused in recent years. First, the 2009 HITECH Act created the “third party directive” which allowed patients to direct a covered entity to send a copy of their PHI contained in an Electronic Health Record to a third party without the need for a valid authorization. HITECH made it much easier for third parties to obtain patient PHI contained in EHRs. Second, the 2013 Omnibus Rule broadened the “third party directive '' created by the HITECH Act to allow patients to direct a covered entity to send to a third party PHI in any format, not just in an EHR. The Omnibus Rule also amended that portion of the Privacy Rule specifying the costs recoverable under the Patient Rate, stating such cost could include skilled technical staff time spent to create and copy the electronic file, such as compiling, extracting, scanning and burning PHI to media and distributing the media (but not labor costs associated with the retrieval of electronic information).
Then, in 2016, HHS published additional guidance (the “2016 Guidance”) which caused a major shift in the industry, ultimately leading CIOX Health to file suit. In the 2016 Guidance, HHS expanded the Patient Rate to an individual’s request to send the records to a third party, regardless of whether the request was submitted by the patient or whether the request was submitted by the third party on the patient’s behalf. As a result, health care providers and medical records companies were no longer allowed to charge the fees authorized by state law for those medical records requested by the patient to be provided to third parties such as attorneys. According to CIOX Health, these changes cost CIOX Health over $10 million per year ($35 million in lost revenue in 2017 and 2018).
Ciox Health filed suit, challenging both the 2013 Omnibus Rule and the 2016 guidance for violating the procedural and substantive requirements of the Administrative Procedures Act. The Court held the 2013 Omnibus Rule compelling delivery of PHI to third parties regardless of the records’ format was arbitrary and capricious. Additionally, and perhaps more importantly, the Court held that the 2016 Guidance expanding the Patient Rate to third party directives (i.e., lawyers) violated the APA and should have been subject to notice and comment rulemaking.
For now, the limit on fees that health care providers and medical record companies are allowed to charge third parties, like law firms and insurers, no longer applies. HHS has acknowledged the Ciox Health ruling, stating that that the Patient Rate does not apply to an individual’s request to transmit records to a third party, but the full impact of the Court’s order remains to be seen. Health care providers and medical record companies should stay tuned for potential rulemaking by HHS or subsequent litigation resulting from the Court’s decision.