HHS Addresses Federal Court Invalidation of Certain Provisions of the HIPAA rule Relating to the Third-Party Requests for Patient Records

Epstein Becker & Green

Epstein Becker & Green

On January 28, 2020, the Department of Health & Human Services (“HHS”) Office for Civil Rights (“OCR”) addressed a federal court’s January 23rd invalidation of certain provisions of the Health Insurance Portability and Accountability Act (“HIPAA”) rule relating to the third-party requests for patient records. In Ciox Health, LLC v. Azar,[1] the court invalidated the 2013 Omnibus Rule’s mandate that all protected health information (“PHI”) maintained in any format (not just that in the electronic health record) by a covered entity be delivered to third parties at the request of an individual, as well as the 2016 limitation on fees that can be charged to third parties for copies of protected health information (“PHI”).

As enacted, HIPAA’s Privacy Rule limits what covered entities (or business associates acting on behalf of covered entities)[2] may charge an “individual” requesting a copy of their medical record to a “reasonable, cost-based fee”[3] (the “Patient Rate”). The Privacy Rule did not, however, place limitations on the fees that can be charged to other requestors of this information, such as other covered entities that need copies of the records for treatment purposes or for disclosures to attorneys or other third parties.  In order for some of these third parties to obtain the records, the patient would have to provide the covered entity with a valid HIPAA authorization.  

In 2009, Congress passed the Health Information Technology for Economic and Clinical Health Act (“HITECH”), which entitled patients to direct the covered entity to send their PHI contained in an electronic health record to a third party “in an electronic format”[4] without the need for a valid authorization (the “third-party directive”).[5] HITECH also implemented a limitation on the fees that can be charged to patients, but not third parties, for the delivery of these requested records.[6]

Ciox Health’s challenge centered around later regulatory changes to HIPAA stemming from the 2013 Omnibus Rule and a 2016 guidance document issued by OCR (the “2016 Guidance”).

The 2013 Omnibus Rule expanded HITECH’s third-party directive beyond its application to PHI contained in electronic format to cover PHI contained in any format, and mandated that covered entities send the PHI in the format requested by the individual. Ciox Health challenged this change as violative of the Administrative Procedure Act (“APA”) because it conflicts with the plain language of HITECH. The court agreed.

Ciox Health also brought an APA challenge against the 2016 Guidance. Despite the Privacy Rule placing limitations on fees charged to an “individual” for a copy of their PHI,[7] the 2016 Guidance stated the Patient Rate must also be charged to third parties. The APA requires that agency rules that would change the law or impose new obligations must undergo a notice and comment period. HHS adopted the 2016 Guidance without notice and comment. The court found this application of the Patient Rate to third parties represented a change in the law, and that without notice and comment HHS had no authority to adopt the 2016 Guidance.[8]

This case is significant, because as noted by Ciox Health in its arguments, the changes made by the 2013 Omnibus Rule and the 2016 Guidance were a glaring departure from the industry’s previous understanding of the law.[9] Prior to the court’s decision (and OCR’s change in policy), covered entities and the business associates acting on their behalf faced an increased burden to collect patient PHI in any and all formats and transmit copies of the information, in the requested format, to third parties for a limited fee, instead of the state-authorized or independently-contracted rates that were charged prior to the 2016 Guidance.[10] The resulting financial losses were only exacerbated by a significant increase in third-party directive requests, as entities realized that the higher fees could be avoided through the use of third-party directives.[11]


[1] No. 18-cv-00040 (D.D.C. 2020).

[2] The Defendants maintained that the requirements at issue in this case are applicable to covered entities only, and that they have no enforcement activity with respect to business associates. Id.

[3] 45 C.F.R. § 164.524(c)(4).

[4] 42 U.S.C. § 17935(e)(1).

[5] 42 U.S.C. § 17935(e)(1).

[6] 42 U.S.C. § 17935(e)(3).

[7] 45 C.F.R. § 164.524(c)(4).

[8] However, the court ruled in favor of HHS in regards to Ciox Health’s challenge of the three methodologies for Patient Rate calculation included in the 2016 Guidance on the basis that the relevant language did not impose a requirement on covered entities to adopt one of the methodologies.  Ciox Health, LLC v. Azar, No. 18-cv-00040 (D.D.C. 2020).

[9] Id.

[10] Id.

[11] Id.

[View source.]

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Epstein Becker & Green | Attorney Advertising

Written by:

Epstein Becker & Green

Epstein Becker & Green on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.