Providers are now free to charge law firms, life insurance companies and other third parties more money than they charge patients for protected health information under HIPAA and the Health Information Technology for Economic and Clinical Health (HITECH) Act^[1] in the wake of a Jan. 23 decision^[2] from the U.S District Court for the District of Columbia. In Ciox Health, LLC vs. Azar, et al., the court voided the third-party directive in 2016 guidance from the HHS Office for Civil Rights (OCR) as well as a provision from the 2013 Omnibus Rule that interpreted the HITECH Act. The provision required covered entities to deliver protected health information (PHI) in all formats, electronic and otherwise, to third parties at a patient’s request, but the court ruled that HHS strayed too far from the statute.

“Returning to charging higher rates to third parties is now an option” if it’s allowed by state law, said Richelle Marting, an attorney in Overland Park, Kansas. Providers are not obligated to change their rates, and an HHS appeal may be on the horizon, she said.

The court decision resolves, for now, a battle between Ciox Health, a medical records release company, and OCR over how much money covered entities (e.g., hospitals) and their business associates can charge patients and third parties for medical records, and again pushed back at the enforcement of guidance that isn’t rooted in notice-and-comment rulemaking. OCR emphasized in a statement that the right of patients to access their own records and limits on associated charges remain “undisturbed.”