In an age dominated by electronic records of all kinds (and especially in the healthcare field), you may not give more than a passing thought to the costs of reproducing and sharing those records. But one medical records production company has done more than thought about it…it has initiated litigation centered around this very issue. Who is the company suing? None other than the government itself.
Georgia-based CIOX Health, LLC is a Release of Information (ROI) specialty company that contracts with healthcare providers to reproduce medical records upon request. The organization says that each year it fields requests for copies of medical records numbering in the tens of millions and that associated expenses in satisfying the requests are substantial.
ROI company says HHS policies defy the “plain language” of HITECH
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) requires that business associates (the designation of ROI organizations under the Act) must release protected health information (PHI) while adhering to HIPAA regulations as well as the state’s privacy laws. Violating those rules would leave the ROI organization at risk for incurring penalties, both civil and criminal.
Earlier this month, CIOX filed a lawsuit in the U.S. District Court for the District of Columbia (CIOX Health, LLC v. Hargan, No. 1:18-cv-00040) that challenges policies of the U.S. Department of Health and Human Services (HHS), namely, a pair of rules that limit how much an entity covered by HIPAA can charge for furnishing copies of medical records to requesters.
The lawsuit opines that the HHS’s 2013 and 2016 policies in this regard contradict the “plain language” of the Health Information Technology for Economic and Clinical Health (HITECH) Act. (And prior to the start of this litigation, the HHS made CIOX aware that it was in violation of the 2016 HHS policy when it allegedly billed for circumstantially excluded fees.)
CIOX asks court for relief, describes more work and less pay
CIOX is asking for declaratory and injunctive relief as it claims that the HHS policies in question will “impose hundreds of millions of dollars in costs that no longer can be recouped by healthcare providers” by preventing the company from passing record reproduction costs on to those parties requesting them.
HIPAA’s original Privacy Rule of 2000 stipulates that providers and business associates authorized by the HHS can “charge a reasonable, cost-based fee” for the reproduction of medical records that the patient him/herself intends to use for personal use only. This fee may include postage costs, when necessary, as well as “the labor and supply costs of copying.” Providers and business associates may not, however, charge fees for retrieving, storing, or processing the PHI in the case of the patient as requester, with the goal of personal use. [65 Fed. Reg. 82462, 82557 (Dec. 28, 2000)]
Those cost restrictions are lifted in the cases of authorized disclosure — for instance, when the requester is a third party such as a health or life insurer or attorney, and the patient has furnished the requester with the necessary authorization to collect his/her protected health information.
ROI company disagrees with HHS’s interpretation of the HITECH Act
The HITECH Act became law in 2009 and added regulations to the transfer of electronic PHI. It also revised what a provider or business associate could charge an individual patient for records transfers. CIOX states the HITECH Act allowed individual patients to instruct providers to send PHI to the requester via electronic health records (EHR) and also that it prevented business associates from levying charges for “ancillary supply or postage costs.”
CIOX’s complaint first states that in 2013 the HHS interpreted the HITECH Act in such a way that the company’s burden of work was unfairly and unduly increased. CIOX says that the rule obliges business associates to send PHI to third parties upon the patient’s request, in whatever format the patient requests, whether or not the information is already in EHR form. [78 Fed. Reg. 5566, 5631 (Jan. 25, 2013)]
Company seeks to charge requesters for labor time
CIOX also claims that the 2016 HHS guidance document in question broadened fee limitations beyond patient-made requests for PHI for individual personal use to also apply to authorized disclosure requests to send information to third parties like health insurers. CIOX states that in this more recent policy, the HHS removed a “concession” it had made in 2013 to allow business associates to charge individuals costs of “skilled technical time spent to create and copy the electronic file.”
In its complaint, CIOX says that the 2016 HHS guidance document prohibited providers from charging for labor time involved in “searching for, retrieving or otherwise preparing the responsive information.”
The company says that this fee exclusion is particularly burdensome since CIOX so frequently fields requests for “any and all” PHI and therefore must employ staff to carefully search for PHI within electronic and paper databases. CIOX claims that it is forced to take on more work for less pay.
This article is provided for educational purposes only and is not offered as, and should not be relied on as, legal advice. Any individual or entity reading this information should consult an attorney for their particular situation. For more information/questions regarding any legal matters, please email [email protected] or call 310.203.2800.