CIOX Health filed a lawsuit Monday against HHS and Acting Secretary Eric Hargan in an effort to stop the agency from enforcing parts of HIPAA it deems "unlawfully, unreasonably, arbitrarily and capriciously" limit the fees providers and their business associates can charge, according to court documents reviewed by Becker's Hospital Review.
CIOX Health, a medical records management company, specifically targets regulatory changes to the privacy law implemented in 2013 and 2016. Those modifications broadened the type of patient information that must be sent, but put a cap on the fees vendors could charge for the added work.
Specifically, the 2013 HIPAA update expanded the type of medical information that could be sent, even if that data wasn't in the EHR. The modification, though, failed to discuss the costs associated with the data's collection and transmission, and HHS acknowledged this update pushed beyond the regulatory language of the Health Information Technology for Economic and Clinical Health Act, according to the lawsuit.
However, when the law was changed again 2016, HHS required vendors to limit the costs associated with all record requests to a reasonable or flat rate of about $6.50. CIOX alleges this flat fee is arbitrary to HIPAA's original intent and potentially hurt its business.
"A $6.50 flat fee … was drawn from thin air and bears no rational relationship to the actual costs associated with processing such requests," CIOX alleges in its complaint.
Though the vendor claims it supports basic HIPAA rules, including patient access to their records, the lawsuit asks the court to strike the 2013 and 2016 modifications.
"HHS's continued application and enforcement of these rules impose tremendous financial and regulatory burdens on healthcare providers and threatens to upend the medical records industry that services them," CIOX claims, according to the suit.
CIOX told Becker's Hospital Review part of the company's motives for bringing the suit, stating, "The long-term viability of the medical-records industry is critical to the delivery of high-quality, error-free and cost-effective healthcare services to patients by ensuring that healthcare providers have timely access to individual medical records."
In November 2017, CIOX was named in a False Claims Act lawsuit that accused 69 Indiana hospitals of overcharging patients for their medical records. "CIOX routinely and repeatedly engaged in a practice, policy and/or scheme to illegally and fraudulently over-bill patients for the provision of medical records," that complaint reads.
CIOX claims to process "tens of millions" of medical records requests each year, and its website asserts that it serves "three out of five hospitals and more than 16,000 physician practices" throughout the 50 states.
More articles on EHRs:
Survey: Tech expertise ranks as No. 1 barrier to AI development among life science pros
American Well connects remote care network to Netsmart EHRs
US Army Regional Health Command-Pacific deploys Vocera tech at 3 facilities