On January 28, 2020, the Department of Health & Human Services (“HHS”) Office for Civil Rights (“OCR”) addressed a federal court’s January 23rd invalidation of certain provisions of the Health Insurance Portability and Accountability Act (“HIPAA”) rule relating to the third-party requests for patient records. In Ciox Health, LLC v. Azar,[1] the court invalidated the 2013 Omnibus Rule’s mandate that all protected health information (“PHI”) maintained in any format (not just that in the electronic health record) by a covered entity be delivered to third parties at the request of an individual, as well as the 2016 limitation on fees that can be charged to third parties for copies of protected health information (“PHI”).

As enacted, HIPAA’s Privacy Rule limits what covered entities (or business associates acting on behalf of covered entities)[2] may charge an “individual” requesting a copy of their medical record to a “reasonable, cost-based fee”[3] (the “Patient Rate”). The Privacy Rule did not, however, place limitations on the fees that can be charged to other requestors of this information, such as other covered entities that need copies of the records for treatment purposes or for disclosures to attorneys or other third parties.  In order for some of these third parties to obtain the records, the patient would have to provide the covered entity with a valid HIPAA authorization.  

In 2009, Congress passed the Health Information Technology for Economic and Clinical Health Act (“HITECH”), which entitled patients to direct the covered entity to send their PHI contained in an electronic health record to a third party “in an electronic format”[4] without the need for a valid authorization (the “third-party directive”).[5] HITECH also implemented a limitation on the fees that can be charged to patients, but not third parties, for the delivery of these requested records.[6]

Ciox Health’s challenge centered around later regulatory changes to HIPAA stemming from the 2013 Omnibus Rule and a 2016 guidance document issued by OCR (the “2016 Guidance”).

The 2013 Omnibus Rule expanded HITECH’s third-party directive beyond its application to PHI contained in electronic format to cover PHI contained in any format, and mandated that covered entities send the PHI in the format requested by the individual. Ciox Health challenged this change as violative of the Administrative Procedure Act (“APA”) because it conflicts with the plain language of HITECH. The court agreed.

Ciox Health also brought an APA challenge against the 2016 Guidance. Despite the Privacy Rule placing limitations on fees charged to an “individual” for a copy of their PHI,[7] the 2016 Guidance stated the Patient Rate must also be charged to third parties. The APA requires that agency rules that would change the law or impose new obligations must undergo a notice and comment period. HHS adopted the 2016 Guidance without notice and comment. The court found this application of the Patient Rate to third parties represented a change in the law, and that without notice and comment HHS had no authority to adopt the 2016 Guidance.[8]

This case is significant, because as noted by Ciox Health in its arguments, the changes made by the 2013 Omnibus Rule and the 2016 Guidance were a glaring departure from the industry’s previous understanding of the law.[9] Prior to the court’s decision (and OCR’s change in policy), covered entities and the business associates acting on their behalf faced an increased burden to collect patient PHI in any and all formats and transmit copies of the information, in the requested format, to third parties for a limited fee, instead of the state-authorized or independently-contracted rates that were charged prior to the 2016 Guidance.[10] The resulting financial losses were only exacerbated by a significant increase in third-party directive requests, as entities realized that the higher fees could be avoided through the use of third-party directives.[11]


[1] No. 18-cv-00040 (D.D.C. 2020).

[2] The Defendants maintained that the requirements at issue in this case are applicable to covered entities only, and that they have no enforcement activity with respect to business associates. Id.

[3] 45 C.F.R. § 164.524(c)(4).

[4] 42 U.S.C. § 17935(e)(1).

[5] 42 U.S.C. § 17935(e)(1).

[6] 42 U.S.C. § 17935(e)(3).

[7] 45 C.F.R. § 164.524(c)(4).

[8] However, the court ruled in favor of HHS in regards to Ciox Health’s challenge of the three methodologies for Patient Rate calculation included in the 2016 Guidance on the basis that the relevant language did not impose a requirement on covered entities to adopt one of the methodologies.  Ciox Health, LLC v. Azar, No. 18-cv-00040 (D.D.C. 2020).

[9] Id.

[10] Id.

[11] Id.

Back to Health Law Advisor Blog

Search This Blog

Blog Editors


Related Services



Jump to Page


Sign up to receive an email notification when new Health Law Advisor posts are published:

Privacy Preference Center

When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer.

Strictly Necessary Cookies

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.

Performance Cookies

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.