In this article, Kastorf Law analyzes the effect of the Ciox decision on HITECH letters. Kurt Kastorf regularly co-counsels with Georgia trial attorneys on their most difficult matters. Learn more about his embedded trial practice here.
What is the impact of Ciox v. Azar on obtaining medical records via HITECH letter?
What impact will Ciox v. Azar have on HITECH letters? Kastorf Law’s post on HITECH letters generated a lot of questions about the United States District Court for the District of Columbia’s recent decision in Ciox Health, LLC v. Azar, Case No. 18-cv-00040 (APM). You can read the opinion in that case here and the U.S. Department of Health and Human Services’ statement on it here.
As HHS explains:
On January 25, 2013, HHS published a final rule entitled “Modifications to the HIPAA Privacy, Security, and Enforcement Rules Under the Health Information Technology for Economic and Clinical Health Act, and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules.” (2013 Omnibus Rule). A portion of that rule was challenged in federal court, specifically provisions within 45 C.F.R. §164.524, that cover an individual’s access to protected health information. On January 23, 2020, a federal court vacated the “third-party directive” within the individual right of access “insofar as it expands the HITECH Act’s third-party directive beyond requests for a copy of an electronic health record with respect to [protected health information] of an individual . . . in an electronic format.” Additionally, the fee limitation set forth at 45 C.F.R. § 164.524(c)(4) will apply only to an individual’s request for access to their own records, and does not apply to an individual’s request to transmit records to a third party.
That may be a bit dense. Here’s a simpler version: HHS has long established “patient rates” for medical records. For years, record providers assumed that the limitations imposed by the patient rates applied only to requests made by the patient for use by the patient. They therefore refused to provide reduced cost records via HITECH letter to commercial entities, such as insurers and law firms.
Then, in 2016, HHS issued a guidance document that makes clear that the patient rate applies even to request via HITECH letter to deliver information to third parties. Those new rules were a great tool for attorneys to obtain medical records at reduced cost.
This new decision by the District Court of the District of Columbia invalidates that rule, so we are, at least in the short term, back in the old framework where attorneys can expect medical record providers to assert that law firms are not entitled to the patient rate.
HHS notes that the decision has no effect on the right of individuals to access their own records:
The right of individuals to access their own records and the fee limitations that apply when exercising this right are undisturbed and remain in effect. OCR will continue to enforce the right of access provisions in 45 C.F.R. § 164.524 that are not restricted by the court order.
Let’s address a couple short term questions about the impact of this decision.
Why does Azar matter to personal injury attorneys?
As covered in this article, HITECH letters are a great way for plaintiffs’ attorneys to reduce the cost of medical records by requesting them in electronic form from the provider. Invalidation of the third-party directive potentially limits attorneys’ ability to use HITECH to reduce the cost of medical records.
Are HITECH letters in Atlanta, GA effected?
Azar is a district court opinion not from the Eleventh Circuit, so your first question might be whether it immediately affects personal injury practice in Georgia. The short answer is yes. Successful challenges to agency regulations brought in the District of Columbia generally result in that regulation’s invalidity, and the case is then remanded to the agency for further consideration. That will be the case here; HHS will need to determine whether they will re-issue some variation of the third-party directive, and then propose the new rule. There is no need for the Northern District of Georgia or the Eleventh Circuit to issue a similar decision.
Will HHS appeal the Azar decision?
HHS has a statutory right to appeal the decision. It is too early to tell if they will. Generally, when a cabinet level agency wants to pursue an affirmative appeal, it first must obtain permission from the Solicitor General. The SG’s office declines to authorize appeals from the majority of adverse decisions against agencies in Federal court, but may agree to do so when it determines both that there is a viable appeal and either the agency’s operation will be significantly effected or the opinion addresses an important issue of law.
The agency and the SG still have several weeks to file a notice of appeal. Even if they do file a notice, it is no guarantee they will pursue the appeal. The Department of Justice not infrequently files “protective notices of appeal” to buy more time to make a decision about whether to pursue an appeal, then dismisses the appeal prior to filing its opening brief. HHS and the SG’s office may well decide in the meantime that the best way to proceed is to accept a remand and begin implementation of a new rule (or simply drop the issue and move on).
Can HHS fix the third-party mandate on remand?
If HHS chooses to take a remand (or loses an appeal), can it reinstate a third-party directive on appeal?
Let’s start with the easiest aspect of this question: Is HHS even allowed to reissue a third-party directive for HITECH letters after it has been struck down? Yes. The decision does not prevent the agency from attempting to re-issue a similar rule on remand. Agencies can’t generally be enjoined from implementing a particular type of regulation. When a court strikes down a regulation under the APA, the appropriate remedy is remand for further consideration. If HHS can come up with an alternative legal basis for issuing the rule, it can reissue the rule and perhaps survive a subsequent court challenge. Concepts like res judicata and other forms of estoppel do not apply to government agencies in the same way in which they apply to private litigants.
Now here’s the somewhat harder question: can HHS craft a revised rule that won’t simply be invalidated in a subsequent lawsuit? The court’s reason for invalidating the third-party mandate is narrow. HHS needed to subject the mandate to notice and comment, and did not do so. HHS can certainly fix that problem on remand. The court expressly declined to reach Ciox’s substantive challenge to the directive. But, the court certainly appeared skeptical that such a directive would have support in the text of the act. It pledged to keep an open mind, but there seems to be a serious possibility that a rule implemented through notice and comment would also fail an APA challenge.
Will HHS fix the third-party mandate on remand?
Way too early to tell. If someone tells you they know where HHS will come out on this and they don’t have “deputy secretary” in their title, take it with a grain of salt.
Are there other legislative and regulatory solutions available?
Yes. The most obvious one is to push state legislatures, such as the Georgia General Assembly, to pass state HITECH Acts that include a third-party mandate. Remember that both trial attorneys and insurance companies are forced to overpay for medical records, so there is an incentive to push for reform on both sides of the personal injury aisle.
What is the short-term solution for personal injury attorneys who want reduced cost medical records?
The most obvious option if personal injury attorneys in Georgia want reduced cost medical records is to have their patients request that those medical records be sent directly to them. Attorneys can prepare a draft letter for their clients to send directly, under the client’s name, and with the client’s home address listed as the delivery address.
Can you list your law firm address as the delivery address in a HITECH letter?
There’s really two questions here. Can you list your address, and should you.
Let’s address “can” first. A few attorneys have reached out asking if, post-Azar, they would risk running afoul of a court case or regulation by continuing to request that records be sent to their firm address. The answer is likely no. The effect of the decision is to place us back in the pre-2013 world in which attorneys assert they are entitled to the records and medical record providers claim that if the records are going to an attorney they are not for client use. The decision does not bar you from sticking to your guns, it just affects how providers will respond to your position.
As for “should,” at least for clients who are not highly reliable, it might be tempting to list “Client’s Name c/o Law Firm” in the delivery address on the HITECH letter. The problem with this approach is it seems likely to give record providers an excuse to bill you at an excessive rate. Medical record providers’ long-term position has always been that the patient rate is only for requests made by the patient for use by the patient. If the provider can discern from the letter that the records are going to a lawyer, they will probably attempt to bill you at their list rates. And early reports are that at least some record providers (including, unsurprisingly, Ciox) are doing just that.
There are alternative strategies for dealing with unreliable clients. For example, when you have them sign the draft HITECH letter, you can also give them an addressed and postage-paid envelope to deliver the records back to you. This approach might also help with certification, discussed below.
Can you use a P.O. box as the delivery address?
Some attorneys Kastorf Law has talked to are considering obtaining a permanent P.O. box that their clients can use as the return address for medical records. That way, once a client sends the letter, the attorney will be able to pick up the records him or herself, without an additional opportunity for delay.
This option seems likely to be effective in the short term, though as record providers notice the pattern, it is possible they would attempt to refuse P.O. Boxes or require proof of ownership. That strategy seems to expose them to a fair amount of risk of a civil rights action, however, so they may relent and simply mail the records.
What should you do if you send a request before the decision was announced and are now being billed at the higher rate?
As several attorneys have already discovered, if you sent a request to Ciox before the Azar decision came out but it has not been fulfilled yet, Ciox (and probably other providers) is attempting to bill at the higher post-Azar rate, and quoting Azar as the reason.
As aggressive as this sounds, they’ve got an argument for doing so. This situation is not like a statutory amendment that has prospective application only. Instead, because the district court has held that the rule was never implemented properly, Ciox can argue they were legally entitled to bill you at the higher rate when you sent your request — we just did not know they could do that yet.
With that being said, I’ve heard reports that if you escalate your dispute within Ciox several levels, they will give up this position and agree to bill for record requests sent before the Azar decision at the customer rate. This isn’t a hill worth them dying on, since they have a strong claim for charging outrageous bills going forward. So, if you’re inclined to fight, you can probably get a reduced rate on requests you’ve already sent.
Can records sent to your client be certified?
One potential problem with getting records sent to your client is how to deal with certified copies. Scott Harrison for example, has raised reasonable questions both about whether medical record providers will send certified records to clients and whether those records can be used at trial if they have been in the client’s possession.
Let’s first address the question of whether record providers will provide the certification. The short version is: it remains unclear.
Providers may well take the position that if the client wants the record certified, it must mean they want it for some use other than their own. Trial lawyers should push back on this concept, but its not clear yet how this issue will play out.
One way to push back, as Ryan Locke, who has done lots of thinking on HITECH points out, is to direct providers to the Federal Regulations implementing HITECH, which clearly contemplate sending affidavits in support of litigation to patients. 78 Fed. Reg. 5636 (Jan,. 25, 2013). A risk is that providers will respond that because this regulation clearly contemplates the use of the record for some purpose other than personal use, it may well be invalid. The response is that the Federal Register comment is in support of the 2013 rule-making, which was adopted pursuant to notice and comment, and could not have been invalidated by Ciox v. Azar, which is limited to the portions of the 2016 policy that were not subject to notice and comment. If trial attorneys are consistent about pushing back on providers, they may realize that they need to provide certifications at least and until they get a re-imposed rule invalidated on the merits.
Some reason to be optimistic: Chris Carpenter at ChartSquad reports that his company has about an 80% success rate getting medical providers to certify client records, which means balking at this request (at least prior to the Ciox decision) is the minority approach.
Let’s assume that medical record providers take the hardest possible line. Even under these circumstances, you should still probably have clients request their uncertified records. Most cases settle before trial, and the ones that do go to trial often require renewed record certifications on the eve of trial. Because requests under HITECH are so much cheaper than paying record providers’ arbitrarily-high rates, you’ll still save money in the long run even factoring in duplicative record requests.
Will certified records sent directly to the client be admissible in court?
As for Scott’s second question—will certified records sent to the client be admissible—I plan to add more detailed evidentiary analysis here later, but my initial take is that yes, you can use certified records sent to a client in court. Remember that if certified documents are self-authenticating, then by the plain text of Rule 902, they do not require external evidence of authenticity. Trial lawyers should therefore be taking the position that the act of certification ends the evidentiary inquiry. There’s no criminal-style chain-of-custody analysis contemplated by the rule.
This argument can probably be buttressed by instructing your client to send the documents on to you without even opening the package. Tell the client either to hand deliver the unopened package or immediately place it, unopened, in a larger envelope you have provided to her.
If the client sends the HITECH letter, will the medical provider talk to me?
David Schlacter points out that when a request is sent directly by the client, medical records departments are less likely to speak with the client’s attorney when you call to negotiate for HITECH compliance. One way to address this problem is to include in the client’s template letter an explicit authorization for the attorney to speak on the client’s behalf. The potential problem after Ciox v. Azar is that if medical record providers attempt to aggressively retrench, they may use the authorization as evidence that the record is not really for the patient’s use. At this point, its i too early to predict how providers will behave. We need more data to figure out the best approach to this problem.
What are additional options for trial attorneys to continue to use HITECH letters?
I’ve spoken with ChartSquad, a vendor that helps firm outsource the process of ordering medical records, who is optimistic Viox will not affect their business model, which uses an online portal to send requests directly from the patient to record providers. I’ve asked them to provide me with some metrics about provider compliance rates over the next few months, and will update this post if I receive that data. If providers continue to charge at the patient price, using a vendor may become an increasingly attractive option for personal injury attorneys.
Do you have additional questions?
Because of the volume of questions Kastorf Law has received about HITECH letters, I wanted to post responses to some questions right away. I will update this page with additional analysis over the next week. If you have additional questions about the impact of this decision (or about other regulatory matters), please contact me.
Read more about the Ciox v. Azar
Some more analysis of Ciox v. Azar and HITECH letters is available from the National Law Review and HIPAA Journal.