Privacy and Security

HHS Urges Court to Dismiss Lawsuit from ROI Vendor

In response to a lawsuit filed against it by release of information (ROI) vendor Ciox, the US Department of Health and Human Services (HHS) contends that the suit lacks standing and is asking the US District Court in Washington, DC to dismiss it.

In January of this year, Ciox filed a lawsuit against HHS in regards to two updates to HIPAA—updates which the vendor claims are “irrational, arbitrary, capricious and absurd.” In 2013, HHS released a final rule requiring providers “to respond to transmit health records to a designated individual, and include any medical information housed electronically, even if it is not stored in an electronic health record,” according to FierceHealthcare’s summary.

Additionally, Ciox took issue with 2016 HHS guidance that states any individual or entity requesting a person’s medical records, including ROI vendors, insurance companies, and law firms, can only be charged a reasonable, cost-based fee. Those fees, which also apply to business associates of covered entities, can be determined by the actual cost of labor, the average cost of labor, or a flat $6.50 rate. In its lawsuit, Ciox asked the court to invalidate the 2013 and 2016 modifications that are “in excess of statutory jurisdiction, authority, or limitations, or short of statutory right,” Healthcare IT News reported.

“The long-term viability of the medical-records industry is critical to the delivery of high-quality, error-free and cost-effective healthcare services to patients by ensuring that healthcare providers have timely access to individual medical records,” Ciox said in a statement to FierceHealthcare.

In response, HHS stated in a court filing that Ciox’s claims should be dismissed in full because it lacks “third-party standing to challenge the rule and guidance and because Ciox’s claims are unripe… Indeed, because HHS has not and cannot take enforcement action against Ciox regarding the fees it charges for individual requests of PHI, Ciox cannot raise either an enforcement or pre-enforcement challenge to the Privacy Rule provision and guidance at issue,” the court filing states.

FierceHealthcare reports that Ciox received a warning from the HHS Office for Civil Rights (OCR) for charging an individual $224.65 after sending 353 pages of medical records to her lawyer.

[author] [author_image timthumb='on']/Portals/0/uploads/content_hub/Mary-Butler-Portrait.jpg[/author_image] [author_info]Mary Butler is the associate editor at Journal of AHIMA.[/author_info] [/author]

Tags: data breach, privacy and security