In 2018, Ciox Health, LLC (Ciox) sued Alex Azar, the Secretary of the Department of Health and Human Services (HHS), in an effort to invalidate an HHS rule that caused Ciox “to lose millions of dollars in revenue.” That rule limited Ciox to charging “reasonable, cost-based” fees (typically amounting to $6.50) for medical records produced in response to third-party directives (TPDs) (i.e., where the patient directs a healthcare provider (HCP) to transmit her records to a third party, like her personal injury attorney).
Ciox’s arguments rested on procedural grounds; the court agreed and vacated the rule because it hadn’t gone through the mandated notice and comment process. Now, nearly 11 months after the court’s decision, we’re on our way back to square one, as HHS has responded with proposals that would re-instate the fee limitation vacated by the Azar court.
In HHS’s second go at limiting fees for TPDs, it’s not making the same mistake again. On December 10, 2020, HHS informally published a Notice of Proposed Rulemaking (NPRM) which means the notice and comment process will open soon. The NPRM proposes to modify the HIPAA Privacy Rule in various ways. For this post, we zeroed in on the proposals affecting TPDs and the fees applicable to them.
If adopted, the proposals will give TPDs more real estate under 45 C.F.R. § 164.524. They will take over subsection (d), and the existing language will move down to subsection (e).
Proposed paragraph (d)(1) places an important limitation on TPDs. By its own admission, HHS felt that the Azar decision precludes it from requiring HCPs to transmit an individual’s records to a third party “in the form and format requested by the individual.” Thus, the language of subsection (d)(1) limits the right of an individual to direct copies of protected health information (PHI) to a third party to only electronic copies of PHI in an electronic health record.
With this format limitation on TPDs in mind, HHS proposes to add the following fee limitation on TPDs under paragraph (d)(6):
A covered health care provider may impose a reasonable, cost-based fee for an access request to direct an electronic copy of protected health information in an electronic health record to a third party, provided that the fee includes only the cost of . . . [l]abor for copying the protected health information requested by the individual in electronic form . . .
This language should sound familiar, as it’s substantially similar to the language of existing paragraph (c)(4), which has resulted in the widespread practice of charging $6.50 flat fees for electronic copies of PHI. More importantly, this is the language that, prior to Azar, limited the fees that HCPs – on their own or through clearinghouses like Ciox – could charge for electronic records produced in response to TPDs.
Since the proposal uses the same language, we should get the same result: HCPs again charging flat fees of $6.50 (or possibly less) in response to TPDs, as they did in the pre-Azar era.
At the very least, the proposal will result in the adoption of a federal standard for fees applicable to TPDs, which, in turn, will result in the preemption of state laws that permit higher fees. In Florida, this means fees should no longer be calculated at $1.00 per page (and we should no longer receive invoices for more than $42,000, like this one).
While these proposals are promising, there’s still a long way to go before the resulting final rule is adopted. Between now and then, we imagine that HHS will get pushback from HCPs and clearinghouses. To counter that effort, we encourage you to submit comments to HHS once the NPRM is formally published in the Federal Register (search Docket ID number HHS-OCR-0945-AA00).
In the meantime, read on to our next post, where we discuss a few other proposed modifications to the HIPAA Privacy Rule that we find particularly plaintiff-friendly.