Last Updated: Feb 19, 2020
With its recent decision in the case of Ciox Health LLC v. Azar et al., the United States District Court for the District of Columbia has invalidated two administrative provisions regarding the transmittal of protected health information (PHI) to third parties.
The Court vacated portions of the Omnibus Rule, a set of federal regulations promulgated by the Department of Health and Human Services (HHS) in 2013, insofar as the regulations expand the Health Information Technology for Economic and Clinical Health (HITECH) Act’s third-party directive beyond requests for a copy of an electronic health record (EHR) with respect to PHI of an individual in an electronic format. Additionally, the Court also declared guidance issued by HHS in 2016 that expanded the application of regulatory fee limitations to an individual’s request to transmit PHI to a third party unlawful.
Following this decision, the HHS Office of Civil Rights (OCR) issued an Important Notice Regarding Individuals’ Right of Access to Health Records, which can be accessed here. In this Notice, OCR addresses the district court’s order and reaffirms its commitment to enforcing those rights not restricted by the court order. The right of individuals to access their own records, OCR declares, and the fee limitations that apply when individuals exercise this right are undisturbed and remain in effect.
Background of the Case
In 2018, Ciox Health, a specialized medical records provider that contracts with healthcare suppliers nationwide to maintain, retrieve, and produce individual’s PHI, brought suit against HHS challenging the third-party directive of the Omnibus Rule as well as HHS guidance on fee limitations on the delivery of PHI to third parties amongst other claims.
The HITECH Act as well as the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and their accompanying regulations set forth an array of individual rights with respect to PHI. The HITECH Act was enacted in 2009 to promote the adoption and meaningful use of health information technology including the implementation of EHRs and other supporting technologies.
Regarding an individual’s right to receive a copy of electronic PHI or request that such records be transmitted to a third party, the HITECH Act provides, at 42 USC §17935(e)(1), that “in the case that a covered entity uses or maintains an electronic health record (EHR) with respect to” PHI, an individual has “a right to obtain a copy of such information in an electronic format” and to “transmit such copy” to a third party.
In 2013, HHS promulgated a set of regulations known as the Omnibus Rule. These regulations directed covered entities to transmit PHI maintained in any format to a third party, per a patient’s request, in the form and format requested by a patient if readily producible in that form and format.
Ciox Health challenged the Omnibus Rule’s expansion of the third-party directive by arguing this expansion exceeded the statutory authority endowed to HHS under the HITECH Act. The Court agreed that HHS exceeded their statutory authority in expanding the third-party directive to mandate delivery of PHI regardless of whether such information is contained in an EHR.
To reach this conclusion, the Court examined the plain text of the HITECH Act. The Court opined that the HITECH Act says nothing about a right to transmit, to third parties, PHI contained in any format other than an EHR. Congressional intent in limiting the scope of the HITECH Act’s third-party directive, the Court reasoned, is clear. Thus, the Omnibus Rule’s expansion of the third-party directive conflicts with the plain language of the HITECH Act and goes beyond the statutory requirements set by Congress.
Third Party Fee Limitations
To ensure that patient access to PHI is not thwarted by excessive fees, HHS has adopted rules that limit what individuals may be charged for receiving copies of their PHI.
Under HHS regulations, see 45 CFR §164.524(c)(4), covered entities may charge only a reasonable cost-based fee of individuals requesting copies of their PHI. This fee can include only the cost of labor for copying the record, supplies for creating the copy, postage, and the cost of preparing an explanation or providing a summary of the requested PHI. Regarding copies of electronic PHI (ePHI), pursuant to the HITECH Act, covered entities can charge no more than a fee for the labor costs associated with fulfilling an individual’s request for a copy of their ePHI. These fee limitations are commonly referred to as the ‘Patient Rate.’
In 2016, HHS published an informal guidance document (“2016 Guidance”) which stated that the Patient Rate would apply to patient requests both where the individual requests delivery of the PHI to themselves and where the individual requests transmittal to a third party. In this same guidance, HHS noted that the Patient Rate would not apply to a request made by a third party pursuant to a HIPAA authorization signed by the patient.
The 2016 Guidance also advised that in lieu of calculating the actual or average cost of providing copies of electronic PHI, providers may charge an optional flat rate not to exceed $6.50. Again, this flat rate applied both when delivery of the requested PHI is to the patient and when delivery is to a third party as requested by the patient.
Prior to the 2016 Guidance, the medical record industry understood that fee limitations imposed by the Patient Rate applied only to requests for PHI made by the patient for use by the patient. The 2016 Guidance changed this understanding. In its lawsuit, Ciox Health challenged the legality of these changes to interpretation of the Patient Rate by HHS.
Under federal law, agency actions that change laws or impose new legal obligations are known as legislative rules and must undergo a notice and comment period. The 2016 Guidance was issued by HHS without such a notice and comment period.
The Court concluded that the 2016 Guidance is a legislative rule as it created a change in law with respect to the Patient Rate. To reach this conclusion, the Court examined the plain text of the applicable regulations and statutes, the Court opined that neither HHS regulations nor the HITECH Act make the Patient Rate applicable to third-party directives. Finding no legislative or regulatory source to expand the Patient Rate to third parties, the Court vacated the 2016 Guidance. The Court thus declared the 2016 Guidance unlawful insofar as it, without going through a notice and comment period, extends the Patient Rate to reach third-party directives.
What Does This Mean in the Short-Term for Fees?
Absent a reversal by a court of appeals, new legislative action, or regulatory action by HHS, the court’s ruling means that the Patient Rate for medical records no longer applies in situations where the patient directs the entity holding the medical records to transmit them to a third party, such as an attorney. To maintain the patient rate, the patient will have to request the records and have them transmitted directly to the patient.
At this time, it is not known what further actions HHS might take. The Pennsylvania Medical Society (PAMED) will continue to monitor for additional developments. If new guidance is issued, additional regulations are promulgated, or further court action is pursued, PAMED will update members accordingly.
Keep in mind state guidance on copying fees. The Pennsylvania Department of Health (DOH) annually publishes guidelines and maximum fees that a health care provider or facility may charge in response to requests for production of medical charts or records. PAMED members can access a convenient chart with 2020 copying fees here.