Insight

On January 28, 2020, the HHS Office for Civil Rights posted a notice regarding “Individuals’ Right of Access to Health Records.” The notice was in reference to a recent court order entered by the United States District Court of the District of Columbia in the case of Ciox Health, LLC, v. Alex Azar, et al., No. 18-cv-0040 (D.D.C. January 23, 2020). The Court’s opinion, which is heavy in its discussion of the application of the Federal Administrative Procedures Act, declared as unlawful HHS’s position with regard to the charging of fees for medical records directed to third parties. The opinion also addressed the format in which medical records are directed to third parties. Of particular interest to covered entity medical providers and medical records copying companies is the Court’s opinion that HHS’s 2016 Guidance relating to the charging of fees for medical records directed to third parties is unlawful.

Under the HIPAA privacy rule, fees that can be charged to patients for obtaining a copy of their medical records are limited to the cost of certain labor, supplies, and, if applicable, postage, regardless of state law on the subject.  Prior to the HHS 2016 Guidance, such fee limitations were only applied to individuals requesting their own medical records.  Fees charged to third parties, such as insurance companies and law firms, were not subject to the privacy rule charge limitations and often were in an amount that complied with applicable state law.  However, based on the HHS 2016 Guidance, the individual charge limitations were applicable to a third party if an individual had directed that his/her records be transmitted to such third party.  This interpretation had major implications for companies such as Ciox Health, as well as, covered entities that processed their own medical records requests.  Covered entities, as well as business associates that provide medical records processing services, should familiarize themselves with HHS’s guidance on the Court’s opinion.

If you have any questions, please contact Gunster's health care practice shareholder Bill Dillon.

Related Professionals

Jump to Page

Gunster Cookie Preference Center

Your Privacy

When you visit our website, we use cookies on your browser to collect information. The information collected might relate to you, your preferences, or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. For more information about how we use Cookies, please see our Privacy Policy.

Strictly Necessary Cookies

Always Active

Necessary cookies enable core functionality such as security, network management, and accessibility. These cookies may only be disabled by changing your browser settings, but this may affect how the website functions.

Functional Cookies

Always Active

Some functions of the site require remembering user choices, for example your cookie preference, or keyword search highlighting. These do not store any personal information.

Form Submissions

Always Active

When submitting your data, for example on a contact form or event registration, a cookie might be used to monitor the state of your submission across pages.

Performance Cookies

Performance cookies help us improve our website by collecting and reporting information on its usage. We access and process information from these cookies at an aggregate level.

Powered by Firmseek