Court Decision Clarifies Charges Allowed Under HIPAA for Patient Records

The United States District Court for the District of Columbia has issued a decision that changes certain requirements under the Health Insurance Portability and Accountability Act (HIPAA) with regard to requests for medical records. Specifically, the U.S. Department of Health and Human Services’ (HHS) expansion of limits on amounts charged to produce documents is unlawful along with the mandate broadening delivery of protected health information (PHI) to third parties regardless of format [Ciox Health, LLC v. Alex Azar, et al, Case No. 18-cv-00040 (APM), in the United States District Court for the District of Columbia, January 23, 2020].


In this case, Ciox is a specialized provider of medical records that contracts with healthcare providers nationwide to maintain, retrieve and produce individuals’ PHI. Ciox handles millions of various types of requests for records every year for its clients. This case centers on various legal restrictions and conditions placed by HHS on producing PHI.


The main issue is what a company like Ciox can charge for searching for, retrieving and delivering PHI. To ensure that patient access to PHI was not impeded by excessive fees, HHS adopted rules that limit what companies may charge for delivering PHI. These restrictions are known as the “Patient Rate.”


For years, the medical records industry understood that the limits imposed by the Patient Rate applied only to requests for PHI by patients for use by patients. For other types of requests by commercial entities, such as insurance companies and law firms, the records industry understood that allowable fees were not restricted by the Patient Rate.


In 2016, however, HHS issued guidance that stated that the Patient Rate also applied to requests to provide PHI to third parties. Ciox said that this change caused medical records companies to lose millions of dollars in revenue. Ciox also challenged a regulation adopted in 2013 that requires records companies to send PHI to third parties, regardless of the format in which the PHI is maintained, in the format specified by patients.


With regard to these issues, the Court decided that the rule issued in 2013 requiring delivery of PHI to third parties regardless of format exceeds the statutory requirements set by Congress. With regard to expansion of application of the Patient Rate, the Court declared it to be unlawful.


On January 25, 2020, HHS finalized a rule that modified the Right of Access provisions under HIPAA. Fee limitations for copies of medical records now apply only to individual requests and do not apply to patients’ requests to transmit records to third parties.


Clarification provided by this Court decision should be welcomed by providers.



©2020 Elizabeth E. Hogue, Esq.  All rights reserved.

Southern Web SupportCourt Decision Clarifies Charges Allowed Under HIPAA for Patient Records
Share this post