Access to Clients' Medical Records—Hopes From the Cures Act Reconsidered

Access to Clients’ Medical Records—Hopes From the Cures Act Reconsidered

July 8, 2024
Publications

Attorneys who need their clients’ medical records remember or are aware of the hopes and dashing of hopes that came and went with the implementation of the HITECH Act and then the Ciox v. Azar decision. Then the Cures Act offered new hope. Federal regulations resulting from the Cures Act, some of which were effective at the beginning of 2024, appear not to have delivered on the promise understood to have been made. Attorneys wanted the ability to easily request records for their clients and pay the “patient rate” dangled before us in the HITECH Act. If that was the way you understood the promise, then please reconsider. Current options may be better than you think.

If you gave up on doing HITECH requests and went back to sending requests to providers with the patient’s direction to send the records right to you, following up relentlessly, getting records, and paying the hard-to-stomach cost for electronic records; read on.

I started practicing in 2008. The high-quality firm where I worked knew how to get medical records. There was a stock of the most current authorizations for the release of medical records from local hospitals and medical systems. There was a standard release that was as HIPAA compliant as it could be. Clients signed the releases. The original was kept in the file. The dated copy was sent with a letter to the best-known address for the medical records department of the provider. After one week, a phone call to make sure the provider received the records. After two weeks, a phone call to get a timeline of when the chart would be ready. After 30 days, a follow up letter (by fax if lucky enough to get a fax number when we called) reminding the provider of the timeframe in which they had to produce the records. Get the box of records. Pay the full rate to the provider or their service. There were vendors which offered to do this for attorneys and employing them increased the cost to clients. Most of the time we chose to keep the costs as low as possible and stuck with the in-house system.

In 2009, the American Recovery and Reinvestment Act included the Health Information Technology for Economic and Clinical Health Act (HITECH Act). The HITECH Act allowed the Department of Health and Human Services to modify the privacy rules under HIPAA. 45 CFR 164.524, addressed the access of individuals to their protected health information. By 2016, regulations had created a robust system by which patients, and their designees, could affordably access electronic medical records. At 45 CFR 164.524(c)(3)(ii), the regulations gave the right for a patient to have their records sent to another, “If an individual’s request for access directs the covered entity to transmit the copy of protected health information directly to another person designated by the individual, the covered entity must provide the copy to the person designated by the individual.” The very next section, 164.524 indicated the fees to be charged by the covered entity were limited to labor, supplies, and postage. With electronics records, the labor could be very limited, and so the cost for a patient’s records were potentially very low. The Department of Health and Human services took the position that the very low cost of producing a copy of the records applied whether the patient requested the records for themselves or if they directed for another person to receive the records. In fact, even today, HHS’s website addressing Individuals’ Right under HIPAA to Access their Health Information 45 CFR 164.524 contains the following language statement, “The same requirements for providing the PHI to the individual, such as the fee limitations and requirements for providing the PHI in the form and format and manner requested by the individual, apply when an individual directs that the PHI be sent to another person. See 45 CFR 164.524(c)(3).” See (https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html#maximumflatfee). Attorneys were able to get electronic records for their clients, sent directly to the attorney, for often less than $25 and in some cases as low as $6.50.

For what seemed like a brief time, attorneys could have their clients sign a release directing the covered medical provider to send the records right to the attorney and the fees were very reasonable. A disclaimer which sits atop the HHS page referenced above, though, shows the sea change that was Ciox Health v. Azar.

Ciox Health, LLC, which merged with and is now changing its monicker to Datavant, was a health care information management information company. Among other things, it helped medical providers extract medical records from the providers’ system and fulfill requests for medical records to patients and third parties, like attorneys. Ciox took umbrage at providing records to life insurance companies and law firms at the low patient rates. Ciox sued Department of Health and Human Services (by way of its secretary, Alex Azar) to eliminate, among other things, the patient rate’s application to requests directing the medical records be sent to law firms. Ciox won. The federal district court for the District of Columbia found Health and Human Services had overstepped its bounds when it required any format of record be provided directly to a patient’s designee, and when it required applying the patient rate for records sent to law firms. HHS backed off their previous position by an important notice at the end of January 2020.

Attorneys working for their clients could no longer pay the patient rate for medical records which were sent directly to the attorneys’ office. They were left to either do a work around which required the patient to make the request, get the chart, get the invoice, and get both the records and the invoice to the attorneys’ office; or attorneys could pay the full freight to eliminate the middleman-who was their client. Four years after Ciox, these may seem the only options.

The 21st Century Cures Act passed in December 2016. Implementation of the act by HHS has not produced what attorneys hoped. It did not bring back patient rates for medical records. On the other hand, the Cures Act implementation is making electronic health records more accessible. An initial examination of the act and HHS’s final rules leads me to consideration potential courses of action or attorneys, one which is more a pull strategy and one which is a push.

What I label the pull strategy is for attorneys watch for “information blocking” by the provider or its medical records service. The attorney is looking for health information they know is stored electronically but is not accessible. The concept comes right out of the Cures Act. Generally, information blocking is prohibited and can result in penalties. Information blocking is a practice that is likely to interfere with access, exchange or use of electronic health information. See 45 CFR 171.103. But there are exceptions. There is an exception which specifically addresses when an “… actor’s practice of charging fees for accessing, exchanging, or using electronic health information not be considered information blocking?” But there are exclusions to the exception, one of which is of interest. This fee is excluded from the exception, making it one which could draw the ire of HHS, and it reads, “A fee based in any part on the electronic access of an individual’s EHI [electronic health information] by the individual, their personal representative, or another person or entity designated by the individual.” See 45 CFR 171.302(b)(2). In further explanation, “Electronic access means an internet-based method that makes electronic health information available at the time the electronic health information is requested and where no manual effort is required to fulfill the request.” Instead of exercising one’s right to access their medical records under HIPPA, perhaps the way forward to less expensive medical records will be a claim of information blocking.

Challenges based on information blocking may lie in various places. Perhaps, most simply, there may be a basis for challenge where the provider’s system allows timely access for the patient and a designee to gather and use personal health information without action from the provider, yet the accessible information is incomplete. If the system is capable of providing more information than the provider determines to give or the speed at which it offers the information is throttled, it may open the provider or its business partner for a closer look from Health and Human Services. Another challenge could come where a provider has a full functioning electronic health information management system which has a portal or similar patient-facing capability which the provider chooses not to employ.

What I label the push strategy, is a movement begun under HIPAA, accentuated by HITECH, and now coming to reality under the Cures Act where information is pushed to the patient. Patient portals are becoming very powerful and rich in information. The Cures Act does not require a medical portal. In fact, the word portal does not exist in the text of the act. Regardless, there has been a slow evolution of the type of data which providers and their business partners must make available, which seems to have resulted in greater access through medical portals.

Recognizing anecdotes are not evidence I share an example. My brother lives in central Pennsylvania. He was recently inpatient at a small hospital. Through the provided patient portal, we were able to see results from blood tests, cultures, radiology (reports), consult notes and the attending’s progress notes. If I was with him on Wednesday, I could see all the notes that had generated on Tuesday. It was a huge help in understanding his care and treatment and working with him to make decisions. I knew parts of the chart existed, but they were not available. No MARs, TARs or Flow sheets. But there were vitals shown in a way that indicated trending. It was good information. As providers work to push more of their designated record set onto the portal, more and more information is available.

Can we reconsider how to deal with getting medical records? Records on patient portals are free to download. Attorneys’ offices should work with their clients to access this information. It may be surprising what is there at no cost. Be aware of this term, fast healthcare interoperability resources or “FHIR.” This is a standard that allows phone and tablet apps to ask for health information from providers to be downloaded and stored locally on device. HHS is already moving health information managers to use FHIR. As an example, Apple uses FHIR to pull medical records into its health app. In the health app, there is a “health records” section. A patient can add an account, which opens a selection card/window with a location parameter. It was astounding to see how many providers were already available in central Pennsylvania to get records right in Apple’s health app. Those records are then available to be shared at the patient’s discretion. Take advantage of any provider who makes health data available to an app or service. Then, after identifying the gaps in medical records accessible through a client’s portal or app, make surgical strikes for the remaining records needed for the particular purpose pursued. Where the whole chart is needed, perhaps using the HITECH Act request will still be worth the effort. Records not sought through an electronic means or a HITECH request are fewer and therefore less burdensome cost-wise.

Finally, it will be edifying to follow the development of the final rules coming from the Department of Health and Human Services. The onramp was long, but now the use of technology to access medical records is moving at break-neck speed. Technology is likely to level the field and eliminate or at least reduce attorneys’ reliance on the pay-to-play system.

Joseph Chapman is a personal injury attorney and litigator at McNees Wallace & Nurick and serves clients from Harrisburg. He can be reached at jchapman@mcneeslaw.com and at 717-237-5375.