Ciox Health, LLC, the nation’s largest medical records firm, is hoping to upend the fee structure HIPAA covered entities (CEs) and business associates (BAs) have been applying when patients request copies of their health care information.

In its 44-page suit against HHS filed Jan. 8, Ciox, of Alpharetta, Georgia, contends that the HHS Office for Civil Rights (OCR) exceeded its authority and imposed rules for the collection of fees for records that the firm claims are “irrational, arbitrary, capricious, and absurd.” While the suit takes specific aim at what is charged to third parties, the litigation also questions the prevailing fee of $6.50 per request that is being typically applied regardless of where the records are headed.

The suit is necessary to resolve the issue, Ciox says, because OCR “has accused Ciox of violating” the records access regulations and “has threatened to take enforcement action against the Company if Ciox fails to comply” with them. But it is not the only records company to contend that OCR’s enforcement of the access rules doesn’t always make sense. Chris Carpenter, the founder of ChartSquad, Inc., a five-year-old firm that also fulfills patients’ requests, tells RPP his experiences with OCR demonstrate what he calls “uneven enforcement” (see story, p. 4).

Filed in the U.S. District Court in the District of Columbia, Ciox’s suit seeks an injunction to stop HHS from enforcing regulations and related guidance on records access.

An OCR official told RPP its policy is to refrain from commenting on pending litigation. The agency has until mid-March to file a response in court.

For its part, Ciox did not respond to RPP’s questions about the suit but provided this statement: “The long-term viability of the medical-records industry is critical to the delivery of high-quality, error-free and cost-effective healthcare services to patients by ensuring that healthcare providers have timely access to individual medical records,” it says.

The records regulations were published in January 2013 as part of OCR’s omnibus rule that implemented the 2009 HITECH Act (RPP 2/13, p. 1). More recently, in 2016, OCR published three sets of guidance documents, including some FAQs, addressing records access and fees (RPP 6/16, p. 3).

OCR provided two primary options for pricing. CEs and BAs may either calculate “actual allowable costs to fulfill each request” or use an “average” cost based on average allowable labor costs. CEs (and BAs acting on their behalf, as Ciox is a BA) may charge only for the following items: “(1) labor for copying the PHI requested by the individual, whether in paper or electronic form; (2) supplies for creating the paper copy or electronic media (e.g., CD or USB drive) if the individual requests that the electronic copy be provided on portable media; (3) postage, when the individual requests that the copy, or the summary or explanation, be mailed; and (4) preparation of an explanation or summary of the PHI, if agreed to by the individual.”