Patient medical records

Patient Right of Access After the Ciox Court Victory

Depending on which headlines you read, the January 23, 2019 court decision about the Ciox case either damaged or supported the HIPAA patient right of access rules. The court ruling in the case, Ciox Health v. Alex Azar, is a little bit of both, but this is not the end of the story. The case will likely be appealed and OCR may eventually issue new guidance to clarify its enforcement position.

Patient Right of Access is at the Heart of HIPAA Compliance

Patients who can see and read their medical records are better able to manage their own care, monitor costs, and actively participate in their healthcare. These goals are at the heart of health care policy today, saving costs and helping individuals maintain health.

We have written about the patient right of access to medical records several times over the last year. The Office for Civil Rights (OCR), the agency responsible for overseeing HIPAA, adopted a “Right of Access Initiative” in 2019 to emphasize its importance. OCR is an agency within the U.S. Department of Health and Human Services (HHS) and both enforce HIPAA.

In 2016 HHS issued guidance emphasizing the patient’s right of access to obtain copies of their own medical records. The gist of the guidance was that costs charged should be affordable because excessive costs had been interfering with the right of access. The guidance went further and expanded the “Patient Rate” (reasonable and cost based, or minimal) to requests to deliver records to third parties. In other words, providers were cautioned not to charge more than a minimal fee even to third parties.

Note: Although some states have laws setting rates, HIPAA’s OCR rate is usually lower than the rates commonly set by state law. HIPAA ‘s lower rate supersedes state laws because it is more favorable to patients and their rights.

Patient Right of Access is Intact

The basic patient right of access is intact. The case was mainly about the fees that the provider of records may charge third parties to assemble and transmit records, and the format of the records to be provided, for both patients and third parties.

The underlying rule states that patients have a right to inspect and may obtain a copy of the records in any format they request –  the Ciox ruling addressed two elements: fees and format.

  1. Fees: If patients are charged a fee it should be reasonable, and cost-based, i.e., minimal. This is unchanged. But if the patient asks the records be sent to a third party a higher fee may be charged.
  2. Format: Patients may obtain records in any format they request. This is changed only slightly, limiting a patient’s right to get an electronic copy in those instances where the covered entity doesn’t have an electronic copy readily available in the exact format requested.

What Happened in Ciox?

Ciox is a business associate. It provides medical record storage and retrieval services for health care covered entities. Hospitals are among their larger clients.

Ciox argued in its lawsuit that HHS’ 2016 limitation of fees chargeable by third parties caused Ciox and other medical records companies to lose millions of dollars in revenue.

On May 24, 2019 HHS, no doubt in response to concerns raised by business associates like Ciox, said it would not enforce medical record retrieval fee limitations against business associates. Although HHS went further and said it would enforce the fee limitations against covered entities.

In 2020 the court agreed with Ciox and struck down a portion of the 2016 guidance which had extended the “Patient Rate” to copies a patient directs be sent to third parties.

The question now is will covered entities absorb the costs? Under HHS’ current stance, covered entities using Ciox, or another business associate for records storage, have no choice but to absorb the fees. The fight may continue between covered entities and business associates, but patients should not pay more.

What About Lawyers Claiming the Patient Rate?

The Ciox case makes clear that lawyers can no longer claim the Patient Rate, even if a patient requests that records be sent to their lawyer. OCR has always maintained that lawyers and others obtaining records for commercial purposes could not claim to pay the Patient Rate – although some have described OCR’s guidance on this as less than clear. Today there should be no question.

The HIPAA E-Tool® Stays Current with HIPAA

If HIPAA changes, The HIPAA E-Tool® changes with it. We track OCR and HHS guidance, OCR investigations and settlements and private lawsuits like Ciox Health v. Alex Azar.

If you have questions, we have answers.

The HIPAA E-Tool® makes compliance fast and easy. Get your free HIPAA Quick Start Kit, complete with a webcam privacy guard, HIPAA Hot Zone labels and a HIPAA checklist delivered directly to your office.

Share This Post

Maggie Hales

Maggie Hales is a lawyer focusing on health information privacy and security. As CEO of ET&C Group LLC she advises health care providers and business associates in 36 states, Canada, Egypt, India and the EU, using The HIPAA E-Tool® to deliver up to date policies, forms and training on everything related to HIPAA compliance.

Copyright © 2022 ET&C Group LLC.

The HIPAA E-Tool® and Protecting Patient Privacy is Our Job®
are registered trademarks of ET&C Group LLC

Terms of Service | Privacy Policy

Mailing Address
The HIPAA E-Tool
PO Box 179104
St. Louis, MO 63117-9104

8820 Ladue Road Suite 200
St. Louis, MO 63124

Free hipaa kit!

hipaa compliance Quick start kit
Delivered free