Ciox Health, a Georgia-based healthcare technology firm, has filed a lawsuit against the U.S. Department of Health and Human Services (HHS) to block enforcement of HIPAA rules that cap fees for medical records. The company argues the 2013 rule changes and 2016 enforcement guidance impose “tremendous financial and regulatory burdens” on providers and threaten the medical-records industry. The lawsuit, filed in Washington, D.C., calls the updates to the federal privacy law “irrational, arbitrary, capricious, and absurd.” Ciox claims HHS’s actions contradict the HITECH Act, which limited fees only for patient requests, not third-party ones. The company processes tens of millions of medical records requests annually, serving three out of five hospitals and over 16,000 physician practices nationwide.
The 2013 rule required providers to transmit all electronic health information, regardless of its source, without accounting for the costs involved. HHS acknowledged the rule exceeded the HITECH Act’s original language, according to the complaint. The 2016 guidance further limited fees to $6.50 or actual labor costs, a move Ciox says “bears no rational relationship” to real expenses. The company’s legal argument hinges on the assertion that the 2013 and 2016 changes were not aligned with statutory mandates, particularly the HITECH Act’s explicit focus on patient-initiated requests. HHS’s 2013 rule, for instance, mandated that providers include any electronically stored health information—whether from an electronic health record (EHR) system or other repositories—without providing mechanisms to offset the logistical and operational costs of compiling such data.
Ciox faced scrutiny in 2017 when an OCR official warned it may have violated HIPAA after charging $224.65 for a 353-page record request from a lawyer. The company argues such fees are unsustainable, as 4% of its requests come from patients, while 40%-50% involve provider-to-provider transfers—both handled free of charge, subsidized by third-party revenue. This business model, which relies on third-party requests to offset costs, is at risk of collapse under the current fee structures, according to Ciox. The firm claims that the $6.50 flat fee, which applies to third-party requests, fails to cover the actual expenses of retrieving, compiling, and transmitting records, which often involve manual labor, software integration, and compliance with multiple legal and technical standards.
“Long-term viability of the medical-records industry is critical to healthcare quality,” Ciox stated in a FierceHealthcare email. HHS did not immediately respond to requests for comment.
Related: Tips on buying a scale
Related: How to repurpose my engagement ring?
Related: The Power Of Video In Branding