HHS on Tuesday lifted a limit on fees that providers and companies are allowed to charge when a patient requests to send their health data to a third party after a federal judge nixed the policy.
The judge ruled that some portions of a 2016 HHS guidance are impermissible under the Administrative Procedure Act, which governs how federal agencies develop regulations and conduct notice-and-comment rulemaking.
The limit on fees that organizations are allowed to charge third parties—such as law firms or life insurers—no longer applies. But Roger Severino, director of the HHS' Office for Civil Rights, said that fees are still capped when a patient requests access to their own records.
"Individuals still have the right to timely access to their own health records at a reasonable cost and OCR will continue to vigorously enforce that right consistent with the court's order," he said.
In 2016, HHS issued a guidance limiting the fees that third parties can be charged when requesting health data on a patient's behalf. The agency placed a cap on all fees, and said third parties could be charged the same amount as patients who request their own data.
HIPAA-covered entities and business associates were directed to charge fees based on calculating the labor cost it takes to fulfill a record request or by charging a flat fee capped at $6.50 per request.
The restrictions on what companies may charge patients—often referred to as the "patient rate"—are meant to ensure patients have affordable access to their own health data.
But extending that rate to third parties should have gone through a notice and comment rulemaking, according to U.S. District Judge Amit Mehta in Washington in his 55-page opinion.
HHS had asked Judge Mehta to dismiss a lawsuit between the agency and Ciox Health, a health information management company that handles record-retrieval requests for providers, patients and third parties.
Ciox sued HHS in 2018, arguing that components of the department's 2013 HIPAA omnibus rule and 2016 guidance violated the APA's procedural requirements. Ultimately, the fee caps led Ciox to lose millions of dollars, according to the ruling.
Ciox on Wednesday emphasized that the ruling did not change the patient rate, but disallowed it for "non-patients," such as insurance companies and lawyers.
"Ciox always has and continues to strongly support patients' secure and unrestricted access to their medical records, including making the process easier," the company said in a statement. "This ruling enables Ciox to continue helping providers achieve these objectives."
Judge Mehta also vacated a HHS rule from 2013 that broadened a directive established in the Health Information Technology for Economic and Clinical Health Act of 2009. HITECH said that patients can request for organizations to send a copy of their electronic health record to a third party, and the rule said that should include any protected health information even if it's not stored in an EHR.
The judge said OCR couldn't add that regulation, since it goes beyond statutory requirements set by Congress.
OCR has been ramping up its work to give patients easier access to their medical information. Last year, the agency announced the first two settlements—both costing providers $85,000—under its right of access initiative, which ensures patients have access to their medical records as mandated under HIPAA.
The ruling raises questions about whether the OCR has the authority to revamp HIPAA, as some lawmakers and healthcare stakeholders have called for in recent years, said Lucia Savage, chief privacy and regulatory officer at digital therapeutics company Omada Health and former chief privacy officer at HHS' Office of the National Coordinator for Health Information Technology.
Savage worked with the OCR to help write the 2016 guidance while at the ONC.
"The court really constrained OCR's authority to write new regulations and interpret new federal laws that come down the pike," she said. "If OCR lacks the authority to refresh and modernize HIPAA as technology evolves, then HIPAA privacy rule is really kind of frozen in time."
