Depending on which headlines you read, the January 23, 2019 court decision about the Ciox case either damaged or supported the HIPAA patient right of access rules. The court ruling in the case, Ciox Health v. Alex Azar, is a little bit of both, but this is not the end of the story. The case will likely be appealed and OCR may eventually issue new guidance to clarify its enforcement position.
Patient Right of Access is at the Heart of HIPAA Compliance
Patients who can see and read their medical records are better able to manage their own care, monitor costs, and actively participate in their healthcare. These goals are at the heart of health care policy today, saving costs and helping individuals maintain health.
We have written about the patient right of access to medical records several times over the last year. The Office for Civil Rights (OCR), the agency responsible for overseeing HIPAA, adopted a “Right of Access Initiative” in 2019 to emphasize its importance. OCR is an agency within the U.S. Department of Health and Human Services (HHS) and both enforce HIPAA.
In 2016 HHS issued guidance emphasizing the patient’s right of access to obtain copies of their own medical records. The gist of the guidance was that costs charged should be affordable because excessive costs had been interfering with the right of access. The guidance went further and expanded the “Patient Rate” (reasonable and cost based, or minimal) to requests to deliver records to third parties. In other words, providers were cautioned not to charge more than a minimal fee even to third parties.
Note: Although some states have laws setting rates, HIPAA’s OCR rate is usually lower than the rates commonly set by state law. HIPAA ‘s lower rate supersedes state laws because it is more favorable to patients and their rights.
Patient Right of Access is Intact
The basic patient right of access is intact. The case was mainly about the fees that the provider of records may charge third parties to assemble and transmit records, and the format of the records to be provided, for both patients and third parties.
The underlying rule states that patients have a right to inspect and may obtain a copy of the records in any format they request – the Ciox ruling addressed two elements: fees and format.
- Fees: If patients are charged a fee it should be reasonable, and cost-based, i.e., minimal. This is unchanged. But if the patient asks the records be sent to a third party a higher fee may be charged.
- Format: Patients may obtain records in any format they request. This is changed only slightly, limiting a patient’s right to get an electronic copy in those instances where the covered entity doesn’t have an electronic copy readily available in the exact format requested.
What Happened in Ciox?
Ciox is a business associate. It provides medical record storage and retrieval services for health care covered entities. Hospitals are among their larger clients.
Ciox argued in its lawsuit that HHS’ 2016 limitation of fees chargeable by third parties caused Ciox and other medical records companies to lose millions of dollars in revenue.
On May 24, 2019 HHS, no doubt in response to concerns raised by business associates like Ciox, said it would not enforce medical record retrieval fee limitations against business associates. Although HHS went further and said it would enforce the fee limitations against covered entities.
In 2020 the court agreed with Ciox and struck down a portion of the 2016 guidance which had extended the “Patient Rate” to copies a patient directs be sent to third parties.
The question now is will covered entities absorb the costs? Under HHS’ current stance, covered entities using Ciox, or another business associate for records storage, have no choice but to absorb the fees. The fight may continue between covered entities and business associates, but patients should not pay more.
What About Lawyers Claiming the Patient Rate?
The Ciox case makes clear that lawyers can no longer claim the Patient Rate, even if a patient requests that records be sent to their lawyer. OCR has always maintained that lawyers and others obtaining records for commercial purposes could not claim to pay the Patient Rate – although some have described OCR’s guidance on this as less than clear. Today there should be no question.
The HIPAA E-Tool® Stays Current with HIPAA
If HIPAA changes, The HIPAA E-Tool® changes with it. We track OCR and HHS guidance, OCR investigations and settlements and private lawsuits like Ciox Health v. Alex Azar.
If you have questions, we have answers.
