HIPAA Rules Modifications for Sending Records to Third Parties

February 2020 ~

A federal judge ruled that the Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) can make modifications to rules for sending records to third parties. The ruling vacates specific provisions in a 2013 rule which modified the Health Insurance Portability and Accessibility Act (HIPAA) and will no longer require covered entities to send non-electronic protected health information to a third party at the patient’s request. Additionally, covered entities will no longer be limited to charging a reasonable cost-based fee when sending records to a third party.

In the case Ciox Health, LLC v. Azar, et al., which vacated the “third-party directive” within the individual right of access “insofar as it expands the HITECH Act’s third-party directive beyond requests for a copy of an electronic health record with respect to protected health information (“PHI”) of an individual … in an electronic format.”

In his decision, U.S. District Court Judge Amit Mehta states “The court holds that: HHS’s 2013 rule compelling delivery of PHI to third parties regardless of the records’ format is arbitrary and capricious insofar as it goes beyond the statutory requirements set by Congress.” The judge also ruled that HHS’s broadening of the Patient Rate in 2016 is a legislative rule that the agency failed to subject to notice and comment and that the agency’s. “Accordingly, the court declares unlawful and vacates the 2016 Patient Rate expansion and the 2013 mandate broadening PHI delivery to third parties regardless of format,” the ruling said.

Following the ruling, the OCR issued a notice, on January 28, announcing that a federal court vacated “third-party directive” within the individual right of access “insofar as it expands the HITECH Act’s third-party directive beyond requests for a copy of an electronic health record with respect to [protected health information] of an individual  . . . in an electronic format.” Additionally, the fee limitation set forth at 45 C.F.R. § 164.524(c)(4) will apply only to an individual’s request for access to their own records and does not apply to an individual’s request to transmit records to a third party.

For more information, see a copy of the court order here and the notice, here.

Source(s): FierceHealthcare; HIPAA Journal; Holland & Hart – Health Law Blog; National Law Review; Health Data Management;