Changes on the Horizon for Charging Fees for Medical Records? Pending Ciox Litigation Raises the Question

Ciox Health, LLC (“Ciox”), a release of information (“ROI”) vendor that contracts with hospitals and other healthcare providers to fulfill requests for copies of medical records, filed suit against the U.S. Department of Health and Human Services (“HHS”) in the U.S. District Court for the District of Columbia on January 8, 2018 (docket number 1:18-cv-00040). In its complaint, Ciox challenges HHS rules, guidance, and enforcement related to producing copies of medical records and fees that providers may charge. Among other arguments, Ciox alleges that the guidance exceeds the authority granted to HHS by statute. Ciox may face some difficulty in pursuing the litigation, with HHS arguing in its Motion to Dismiss that Ciox lacks standing to bring the suit because the rules and guidance apply to “covered entities” (e.g., healthcare providers) and not to their “business associate” vendors, like Ciox. However, any outcome in the case will be significant for providers and ROI vendors.

Determining fees that may be charged for producing copies of medical records is notoriously complicated. Each state has its own rules for the amounts that may be charged, and often these vary based on provider type (e.g., hospitals versus physicians) and the type of request (e.g., for social security benefits or workers compensation versus disclosure to the patient). Further complicating the analysis, HHS issued rules in 2013, followed by extensive guidance in 2016 addressing fees that may be charged under HIPAA to provide copies of records to patients, limiting them to a “reasonable, cost-based fee” and narrowly defining the types of costs may be included in the calculation.

One of the most contentious aspects of the HHS rules and guidance is the instruction that a request by any third party must be treated as a request from the patient if the patient “directs” the covered entity to provide their records directly to the third party. Per HHS, these “third party designation” requests for records are then subject to the same limitations on fees that may be charged when copies are provided directly to the patient. This is significant because the HHS guidance materially limits the definition of the costs that may be included in the calculation of fees charged for providing copies to patients and—per the guidance—to savvy third parties who utilize the “third party designation” avenue for requesting copies. In the guidance, HHS defines what activities may, and may not, be included as “labor costs” for producing copies of records:

“Labor for copying includes only labor for creating and delivering the electronic or paper copy in the form and format requested or agreed upon by the individual, once the PHI that is responsive to the request has been identified, retrieved or collected, compiled and/or collated, and is ready to be copied. Labor for copying does not include costs associated with reviewing the request for access; or searching for and retrieving the PHI, which includes locating and reviewing the PHI in the medical or other record, and segregating or otherwise preparing the PHI that is responsive to the request for copying.” (emphasis in original)

These limitations mean that healthcare providers are routinely required to provide copies of medical records substantially below their realistic cost to do so. With the prevalence of electronic medical records and the huge volume of data that is often included in patient records, the limits may be appropriate when copies are provided to patients (e.g., costs of copies of a complete medical record could easily extend into thousands of dollars, essentially depriving the patient of their right of access if they are unable to afford the fee). However, these limits appear less reasonable when the records are essentially being provided to a commercial third party (e.g., attorneys or insurance companies). Ciox is challenging this position, among other aspects of the HHS rules and guidance.

The HHS guidance is sub-regulatory interpretive commentary, but it indicates how HHS will apply the applicable regulatory provisions. HHS reinforced this understanding in its Motion to Dismiss when it stated that “the guidance imposes no independent legal obligations of its own. Rather, it explains HHS’s current, nonbinding view of the law.” However, this “nonbinding view” is the way HHS has stated it will enforce the regulations, and HHS has already used the guidance as support in certain actions with healthcare providers. Thus, unless HHS—or the Court—changes this view, the guidance remains a critical issue for providers and their ROI vendors to understand as they navigate the complex rules around charging fees for copies of medical records.

Briefing in the Ciox litigation is completed, and the parties’ cross-motions for summary judgment are before the Court. We expect that the outcome of the litigation will have a significant impact for healthcare providers on how they calculate fees for producing copies of medical records:

• • If the rules and guidance are upheld, this will solidify HHS’s current fee calculation scheme, which has the potential to greatly alter the ROI industry and the feasibility for ROI vendors to maintain current business models. This likely means either that fees to healthcare providers will increase for other aspects of ROI vendors’ services, or that there will be fewer ROI vendors providing the services and thus the responsibility and staffing costs for producing copies of medical records will fall more heavily on healthcare providers.

• If any aspects of the rules or guidance are invalidated by the Court, healthcare providers and their ROI vendors will need to carefully analyze how this affects current operations. This has the potential to materially change the framework in which healthcare providers and their ROI vendors have been calculating fees for copies in recent years.

We will continue to monitor the progress of this litigation and the impacts it has on healthcare providers. For more information on the Ciox litigation or current requirements for producing copies of medical records and assessing fees for their production, please contact H. Carol Saul or Madison M. Pool.