Trial News

The Department of Health and Human Services (HHS) has finalized a long-awaited rule intended to ensure patients can easily access their full electronic health information (EHI) at little or no cost. (Dep’t of Health & Human Servs, Office of the Nat’l Coordinator for Health Info. Tech., 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program, 45 C.F.R. §§170 and 171 (May 1, 2020).) The rule, which codifies the “information blocking” provisions of the 21st Century Cures Act, also attempts to clarify the applicable fees when patients seek to grant third parties, such as their attorneys, access to their EHI—in flux after the D.C. federal district court invalidated a previous HHS rule and guidance on the matter in January. (Ciox Health, LLC v. Azar, 2020 WL 418454 (D.D.C. Jan. 23, 2020).) The rule also incorporates a new standard describing what must be included in the EHI audit log.

The new rule is effective June 30, 2020, but a Nov. 2, 2020, compliance date is set for several of the information blocking provisions. Due to the COVID-19 pandemic, HHS has announced that it will not enforce the new requirements for another three months after this compliance date—meaning enforcement is not expected until February 2021. The rule comes on the heels of the D.C. federal district court’s decision in Ciox Health, LLC v. Azar, in which the court found unlawful and vacated a 2016 HHS guidance that limited fees certain third parties, such as patients’ attorneys, may be charged for copies of protected health information. Under that guidance, attorneys could obtain their clients’ medical records at the “patient rate”—the labor cost for copying after health information has been identified, retrieved, and collated, defined as either the actual labor cost, average labor costs based on a fee schedule, or a flat rate of no more than $6.50. The Ciox court also found unlawful and vacated a 2013 HHS rule that required records companies to provide protected health information to third parties regardless of the records’ format—not just electronic records.

Following Ciox, HHS issued a notice clarifying that the “right of individuals to access their own records and the fee limitations that apply when exercising this right are undisturbed and remain in effect.” (Dep’t of Health & Human Servs, Office of Civ. Rights, Important Notice Regarding Individuals’ Right of Access to Health Records (Jan. 28, 2020).) However, it appeared that attorneys could no longer request records on behalf of their clients and receive copies of the records at the “patient rate.”

To reduce case costs for their clients, Seattle attorney Roger Leslie described how trial attorneys have scrambled to come up with a work-around—asking clients to directly request and receive their health records. This presents a challenge when clients lack the capacity, sometimes due to the injuries at issue in their cases, to easily request their records, Leslie said.

HHS has not appealed the district court’s ruling in Ciox. In moving forward to finalize its rule under the Cures Act, the agency did, however, attempt to address electronic health information access. The rule, released March 9, is intended to prevent “information blocking”—defined under the Cures Act as practices by health information developers, networks, and exchanges or health care providers that are “likely to interfere with, prevent, or materially discourage access, exchange, or [the] use of electronic health information.” The rule states that the “implementation of the Cures Act is predicated on an understanding that access to EHI should not be treated as a commodity that should be traded or sold.” However, it permits limited fees to be charged for EHI “[b]ased on objective and verifiable criteria” that are “[r]easonably related to the actor’s costs of providing the type of access, exchange, or use of electronic health information to, or at the request of, the person or entity to whom the fee is charged.”

For example, EHI supplied through physical media, such as paper copies, a CD, or a flash-drive, may still be subject to a fee without violating the information blocking provisions. Fees may not, however, be based on a patient’s or a patient designee’s “electronic access” to the EHI through internet-based means, such as an application programming interface or patient portal. (45 C.F.R. §171.302)

Ideally under this new rule, Leslie said attorneys should be able to sign up for electronic health portal access and then download their clients’ records at no cost. The Cures Act rule “looks forward to a future where health information moves rapidly and cheaply,” Leslie said. He cautioned, however, “that’s not in the interest of business associate companies like Ciox” and the almost 1,200-page rule “leaves so many opportunities for ‘business associate’ companies to go to court.” For example, under the rule, records produced with no “manual effort” are to be provided to patients and their designees free of charge—but what is “manual effort”? Companies like Ciox may ask courts to interpret that term broadly, allowing them to charge for EHI in contrast to the Cures Act’s “clear and unambiguous intent” to grant individuals a right of access to their records at no cost.

The final rule also incorporates an updated audit trail standard, ASTM E2147–18. (45 C.F.R. §170.299(c)(1).) This standard sets forth minimum data elements that must be included in the audit trail—used to ensure the integrity of medical records. Under the standard, audit logs must include the date and time of access events and data activities, the duration of access, the type of action (data creation, deletion, change, etc.), and unique patient and health information system user identifiers. Legal nurse consultant Nursine Jackson, who chaired the standard development committee, says this new, more detailed standard provides needed clarity to all involved in EHI on what must be contained in an audit log. Jackson described how this detail can be essential to uncovering exactly what transpired during a client’s health care treatment.  

But where the audit standard provides more detail, Jackson lamented that much of the final rule “muddied” EHI requirements that had been well-settled until Ciox. “The Cures Act gives gross concepts without the details for how they come into everyday practice,” Jackson said, echoing Leslie’s concern that companies like Ciox would not hesitate to seek interpretations of provisions favorable to them in court. “When a hospital fails to associate a patient’s specialty care records, and it takes labor to associate those records later—is that ‘manual effort’ for which the records requester can be charged?” Jackson said. “Should patients need to pay for that failure?”

Please set a Datasource.