Earlier this month, CIOX Health, a medical record retrieval company, announced that it was suing the Department of Health and Human Services. The reason for the legal dispute is contention over updates to HIPAA laws which were enacted in 2013. These updates place restrictions on the amount patients may be charged by medical record retrieval companies for providing them with copies of their medical records.
CIOX Health serves more than 16,000 physician practices and processes tens of millions of requests for copies of medical records every year. CIOX Health states the HIPAA Omnibus Rule, “unlawfully, unreasonably, arbitrarily and capriciously,” restrict the fees that can be charged by providers and their business associates for providing copies of the health information stored on patients.
These changes to HIPAA Rules were not limited to placing a restriction on the fees, but also expanded the types of information that must be provided to patients on request. Accessing some of that information is costly for those charged with retrieving it. Additional expenses are encountered when the medical records are not stored in an electronic format, as this is more labour intensive and takes a greater amount of time. Yet, even though the costs of processing some requests are high, HIPAA limits charges to $6.50 according to the lawsuit, regardless of the circumstances involved.
CIOX Health claims that this fee-capping amendment is harming their business. The company argues that this flat rate fee is an arbitrary figure, and does not accurately reflect the costs of retrieving medical information for patients. CIOX Health wants the HHS to reverse the changes made to HIPAA in 2013 and 2016 with respect to how much can be charged and the provision of copies of any type of medical information.
While the flat fee of $6.50 is the maximum that can be charged, it should be noted that the maximum fee only applies if the healthcare provider or company elects this option. HIPAA does not actually stop healthcare organizations from charging their customers more. If they choose not to charge a flat fee, they are permitted to charge patients “actual or average allowable costs for requests for electronic copies of PHI maintained electronically.” This was clarified in May 2016, via the HHS’s web portal.
In the lawsuit against the HSS, CIOX Health says, “HHS’s continued application and enforcement of these rules impose tremendous financial and regulatory burdens on healthcare providers and threatens to upend the medical records industry that services them.” These changes to HIPAA Rules “threaten to bankrupt the dedicated medical-records providers who service the healthcare industry by effectively and quite deliberately mandating that they fulfil a rapidly growing percentage of requests for protected health information at a net loss.”
The changes to the types of health information that must be provided on request now includes medical information stored in any form. This ranges from electronic medical records in EHR systems, to paper records and even to films. Health information must be provided even if it has been transferred to third parties.
Electronic records may be stored several different virtual locations. Similarly, paper records and films may be stored in several different physical locations. In order to obtain copies of the records, staff must be able to access these locations, whether virtual or physical. This may be a time consuming and costly process, depending on the manner in which the records are stored. In addition to accessing the records, due to the sensitive nature of the material the records must be verified and compiled. This adds further costs to the record retrieval process.
CIOX Health is involved with other legal action related to providing patients with copies of their medical records. CIOX is the co-defendant in a November 2017 lawsuit that claims more than 60 Indiana hospitals have been failing to provide copies of medical records to patients within 3 days, as required by the HITECH Act, even though they accepted payments and claimed that they were meeting HITECT Act requirements. The defendants are also alleged to have overcharged patients for copies of medical records.