Nearly four years ago, RPP documented multiple violations of records access requirements included in the 2009 HITECH Act, which broadened patients’ rights to get copies of their medical records (RPP 6/14, p. 1).

Recognizing the problems, the HHS Office for Civil Rights (OCR), which enforces the right under the privacy rule, issued a series of guidance documents in 2016 it hoped would address the widespread noncompliance (RPP 6/16, p. 3).

But did it? Or is the situation worse today?

The answer is somewhat complicated. And it recently spurred a suit being filed by the nation’s largest medical records firm, Ciox Health, against HHS. Ciox claims OCR set a fictitious ceiling of $6.50 per records request and that this is being illegally applied to the growing and voluminous requests made by third parties, such as law firms and insurance companies. As a result, Ciox is being financially crippled, it contends (see story p. 1).

The outcome of the suit, to which HHS has not responded, is yet to be determined. But Chris Carpenter, founder of ChartSquad, a smaller records retrieval vendor that works exclusively for patients, cheers the filing.

Carpenter tells RPP that, if nothing else, the litigation draws attention to OCR’s “uneven enforcement” that he says prompts hundreds of patients per month serviced by his firm to complain to OCR. With rare exceptions, these complaints appear to get scant attention from OCR, he says.