By Beth Anne Jackson, Esq. and Allison Shelton, Esq.
After a decision in Ciox Health Care LLC v. Alex Azar (Ciox) in January, health care providers will no longer be required to subsidize the provision of copies of medical records used by plaintiff attorneys to prove malpractice, personal injury and similar cases.
The scheme was hatched after the Office of Civil Rights (OCR) published guidance in 2016 (Guidance) regarding patients’ ability to request that records be sent to a third party. The Guidance stated that such a request (often referred to as a third-party directive), when initiated by the patient, required that records be sent to the third party at the limited patient rate (as opposed to the state rate promulgated by the Texas Medical Board). Thereafter, plaintiff law firms, who previously sent HIPAA-compliant authorizations to request records (at the state rate), seized upon the Guidance and began 
using forms that made it look like the request was patient-initiated. Typically, however, the request was not patient initiated. Rather, the patient would sign a blank “HITECH” request form, which was then duplicated and submitted by the attorney to multiple providers.
When providers or their business associates (such as release of information (ROI) companies like Ciox) did not comply with attorneys’ demands for records at the patient rate, the attorneys would file complaints with OCR against the provider. OCR generally sided with the law firms, effectively forcing providers to subsidize lawsuits by providing low- and sometimes below-cost records for the firms’ for-profit lawsuits.
The Ciox case was filed after letters were received by Ciox’s clients that threatened OCR action against them. Ciox, as an ROI company, also received an OCR letter that was later rescinded. OCR’s Guidance threatened the business models of Ciox and other ROI companies. Generally, by charging the higher state rate to third parties, ROI companies generate revenue that enable them to provide medical records to individuals and their health care providers at the lower patient rate or even free of charge.
Ciox’s lawsuit challenged both the Guidance and OCR’s 2013 HITECH regulation (HITECH rules) as violations of the federal Administrative Procedures Act (APA), which requires federal agencies to go through a notice and comment process – published in the Federal Register – to create a legally binding rule. Ciox asserted that the Guidance effected substantive changes to existing regulations regarding the applicability of the patient rate and, therefore, was subject to the notice and comment rulemaking process under the APA. With respect to the HITECH rules, Ciox claimed that OCR exceeded its statutory authority by subjecting protected health information (PHI) that was not in an electronic health record (EHR) to the third-party directive when HITECH specifically limited it to PHI in an EHR.
The U.S. District Court for the District of Columbia (Court) held that the Guidance was unlawful because it expanded the patient rate to third-party directives without going through the notice and comment rulemaking process. This holding means that OCR could expand the application of the patient rate to third-party directives if it went through the proper process. With respect to the HITECH rules, the Court found unlawful and vacated the rules to the extent that they expanded the third-party directive to PHI not held in an EHR.
The Court’s decision is great news for the bottom line of providers, especially hospitals. The expansion of the patient rate to third-party directives resulted in the provision of many more records at or below cost. In addition, the limitation of the third-party directive to PHI in an EHR relieves providers of having to provide paper records in the electronic format of the patient’s/attorney’s choice.
Notwithstanding these wins, the Ciox decision does add a bit of complexity to ROI. Specifically, the forms required from the patient in order to release information to third parties will vary based on the PHI’s format. In order to be sent to third parties, paper records must be requested with a HIPAA-compliant authorization. PHI in an EHR, on the other hand, can be sent to a third party when the patient submits a written request that is signed by the patient, clearly identifies the person/entity and where to send the copy.
Providers should remain alert for any moves by OCR to promulgate a rule expanding the application of the patient rate to third-party directives and, perhaps, submit comments opposing it. The plaintiffs’ bar will certainly be submitting comments in support of it.
In the meantime, providers may charge state rates for third-party directives. The Texas Medical Board requires that fees for copies of PHI be “reasonable and cost-based.” The current cap for paper records is $25 for the first 20 pages and 50 cents per page thereafter. For electronic PHI, the cap is $25 for 500 pages or less and $50 for more than 500 pages. Hybrid paper-electronic records are to be charged at the combination of fees for electronic and paper-based records. No specific retrieval fee is allowed, but providers may charge $15 for certifying medical records. Further information on fees for medical records may be found online at www.tmb.state.tx.us.