The HHS Office for Civil Rights (OCR) issued an Important Notice Regarding Individuals’ Right of Access to Health Records through its email list serve on January 29, 2020.  In the Notice, OCR addressed the recent memorandum Opinion issued in Ciox Health v. Azar, et al, No. 18-cv-00040 (D.D.C. January 23, 2020).

In that case, Ciox Health, LLC, a specialized medical records provider, had challenged certain provisions of the 2013 Omnibus Rule, including provisions pertaining to what can be charged for delivering records containing protected health information (PHI). One issue was whether the limitations on fees for these services applied only to requests for PHI that are made by the patient, for use by the patient (the Patient Rate) or whether the limitations also applied to PHI to be delivered to third parties.

An OCR guidance document published in 2016 (the 2016 Guidance) stated the Patient Rate would apply to patient requests, even where the requests directed the delivery of PHI to third parties. The 2016 Guidance noted that the Patient Rate would not apply to requests being made by a third party pursuant to a HIPAA authorization signed by the patient, but cautioned against circumventing the fee limit by treating individual requests for access like other HIPAA disclosures, such as by having an individual fill out a HIPAA authorization when the individual requests access to PHI, including directing a copy to a third party.  The 2016 Guidance also described the types of labor costs recoverable, and identified methods for calculating the Patient Rate.  The case additionally challenged a regulation in the 2013 Omnibus Rule that required PHI sent to the third parties be provided in the form and format requested by the patient, if readily producible in that form and format.

The Court ruled in favor of OCR on one of the issues — holding that identifying the methods for calculating the Patient Rate was not a reviewable final agency action.

The Court vacated — and declared unlawful the “Patient Rate expansion” in the 2016 Guidance and the Omnibus Rule’s “mandate broadening PHI delivery to third parties regardless of format.” The Court held:

(1) HHS’s 2013 rule compelling delivery of PHI to third parties regardless of the records’ format is arbitrary and capricious insofar as it goes beyond the statutory requirements set by Congress; (2) HHS’s broadening of the Patient Rate in 2016 is a legislative rule that the agency failed to subject to notice and comment in violation of the APA; and finally, (3) HHS’s 2016 explanation concerning what labor costs can be recovered under the Patient Rate is an interpretative rule that HHS was not required to subject to notice and comment.

The Court cited to the HITECH Act, noting that it is silent on the allowable fees for PHI when an individual requests or directs the information be provided to a third party and, instead, restricts the fee to labor costs for “providing such individual” a copy of the information.

As OCR explained in its recent Notice, as a result of the Court’s ruling, “the fee limitation set forth at 45 C.F.R. § 164.524(c)(4) will apply only to an individual’s request for access to their own records, and does not apply to an individual’s request to transmit records to a third party.” OCR cautioned, however, that the right of individuals to access their own records and the fee limitations that apply in that context “are undisturbed and remain in effect” and that OCR will “continue to enforce the right of access provisions in 45 C.F.R. § 164.524 that are not restricted by the court order.”