On January 8, 2018, CIOX Health, LLC filed a complaint challenging two HHS policies limiting whether and how much a HIPAA covered entity can charge for providing copies of medical records. According to the lawsuit filed in the U.S. District Court for the District of Columbia, the HHS policies run counter to “the plain language” of the Health Information Technology for Economic and Clinical Health (HITECH) Act. CIOX claims that HHS’s 2013 and 2016 policies will severely limit its ability to share the costs of producing medical records with record requestors and will “impose hundreds of millions of dollars in costs that no longer can be recouped by healthcare providers.” Accordingly, CIOX seeks declaratory and injunctive relief.
CIOX is a “Release of Information” (ROI) specialty organization that contracts with hospitals and other healthcare providers to produce medical records when requested. According to CIOX, it responds to tens of millions of such requests a year and has extensive costs related to receiving, compiling, verifying, and processing the requests. These costs are heightened in an era where health records may be stored in paper or electronic form, on- or off-site, and in systems that may or may not communicate with one another. CIOX, like other ROI organizations, qualifies as a “business associate” under HIPAA and is thus obligated to release protected health information (PHI) in accordance with HIPAA and state privacy laws. Failure to do so would subject CIOX to civil and criminal money penalties.
Under the original HIPAA “Privacy Rule,” HHS authorized providers and business associates to “charge a reasonable, cost-based fee” for copying medical records for personal use by an individual patient, including “the labor and supply costs of copying” and postage. See 65 Fed. Reg. 82462, 82557 (Dec. 28, 2000). Under the Privacy Rule, providers and business associates could not charge individual fees related to retrieving, storing, or processing the information. Id. These cost limitations did not apply in authorized disclosure circumstances (e.g., when a health insurer, life insurer, or law firm requested PHI with prior authorization by the patient).
In 2009, Congress passed the HITECH Act, which regulated the use and exchange of electronic health information. Congress also made changes to the fees a provider or business associate could charge an individual in certain circumstances. According to CIOX, the HITECH Act effectively barred providers from charging “ancillary supply or postage costs,” which made sense given the shift to electronic records. It also, according to CIOX, provided a mechanism for individuals to direct providers to deliver PHI contained in an electronic health record directly to a third party in an electronic format.
In its lawsuit, CIOX first challenges HHS’s 2013 policy interpretation of the HITECH Act, which it claims requires providers to deliver PHI to third parties at an individual’s request, regardless of whether the PHI is contained in electronic format, and in any format requested (not just electronic). See 78 Fed. Reg. 5566, 5631 (Jan. 25, 2013). CIOX claims that this greatly expands its workload as an ROI organization. CIOX acknowledges one “modest concession” in the 2013 policy—providers could begin to charge individuals labor costs like “skilled technical time spent to create and copy the electronic file.” Id. at 5636.
Next, CIOX challenges a 2016 HHS guidance document (current version available here), which expanded fee limitations beyond personal use requests to include authorized disclosure requests to deliver records to third parties, like commercial insurers or law firms. Contrary to the “concession” made in 2013, CIOX claims that HHS backtracked and excluded labor time related to “searching for, retrieving or otherwise preparing the responsive information” from the fees it may charge. This is particularly a problem for CIOX, given the frequency that it receives requests for “any and all” PHI, requiring exhaustive searching for records often on multiple electronic and/or paper platforms. According to the lawsuit, CIOX has to do more for less money as not only are the categories now subject to the expanded fee limitation (including personal use and authorized disclosures), but the allowable charges have been reduced.
CIOX has already been the subject of a notice of violation from HHS, which claimed that CIOX violated the 2016 policy by invoicing purportedly excluded fees in response to an authorized disclosure to a third party.
The case is CIOX Health, LLC v. Hargan, No. 1:18-cv-00040 (D.D.C filed Jan. 8, 2018). The complaint is available here.
