As Americans enter the year 2021, we are reminded of the huge impact technology has had on so many industries, one in particular, the world of Health Information Management. For the past 10 years the Office for Civil Rights and the Department of Health and Human Services have sought to utilize technology to create secure, comprehensive, and accurate health information systems by way of Electronic Health Records (EMR). The American government has subsidized the cost of implementing EMR technology for hospitals and doctors’ offices around the country to further this effort. The goal being ease of access and to reduce the cost of medical records, eliminate paper, and allow patients to have control over their own health information.
10 YEARS and STILL the fight continues. There is an antiquated model in release of information where medical providers or their business associates (better known as copy services) built to gain profit off releasing one’s health information and the market big dogs are not backing down to this day. Despite the clear intent of the legislation, the profit centers remain adamant against this evolution in health information management.
In 2009 the HITECH Act was enacted allowing patients to request electronic records and grossly reducing the fees allowed to be charged in connection with those requests. (42 U.S.C. § 17935(e)(3)). Despite the clear wording of HITECH, the Act was met with complete defiance. The OCR further released several clarifications to promote compliance with the Act. This clarification is codified in the Omnibus Rule released in 2016 stating the patient may request electronic records and the provider must send those records as requested (electronically) and may not charge more than the actual cost of reproducing those records. This fee limitation applies even if the provider does not store the records electronically, and even if the patient requests those records be sent to a third party. Let us be honest, even in 2016, almost every single medical facility did have electronic records and most certainly capable of sending records electronically. Despite this fact, we have seen the providers and copy services create work arounds and invent definitions or rules to circumvent the intent of the legislation to continue the profit center invented prior to the technology available at the time. There was the classic “paper scam” where a medical provider claimed they only had paper records and could only send those records in paper form. This allowed the provider to charge the patient per page, plus shipping, and the labor cost involved in actually physically making a photo copy of these records. In reality, the provider did have an electronic system, was printing the records, then photocopying them, and charging for these efforts. Even though several of these facilities boast their fancy new EMR system through online media, the provider continued to argue that they would only be able to produce paper records. We have heard the argument that email, fax, or the simple drag and drop was not secure, even when the patient waived the security risk, and even though any American knows the USPS is far from the most secure means of transferring private information.
Last year Ciox Health, the largest copy service in the country, sued the HHS over the fee limitations on release of information, arguing that the limitations result in a massive profit loss which is unfair to those like Ciox operating in release of information. Now, as you read this, I would hope your eyes are rolling. So, instead of focusing their efforts on the patient and the need to be able to access, control, and transfer one’s medical information, in the best interest of the individual and continuing medical care, the HHS is in court defending the legislation because it is unfair that Ciox will be required to alter its business model, or be in the position of making less profit. Wow. The judge in Ciox v. Azar ruled that because the HHS did not follow the Administrative Procedures Act in regard to notice and comment, the HHS cannot enforce the portion of the HITECH Act that states the patient rate applies to requests from the patient directing records to a third party and only electronic health records are subject to the patient rate. All paper records, or requests for paper records would not be enforced.
This brings us to the 21st Century CURES Act. The CURES Act is designed to promote interoperability. Interoperability is the secure access to health information through application programming interfaces (APIs) to allow individuals ease of access to electronic health information. The Act also implements “Information Blocking.” In essence, the CURES Act furthers that very clear intent to allow patients control and access over their personal health information (PHI) without having to pay exorbitant fees for this access. You would think we are getting closer to accomplishing the HITECH legislative intent.
And eureka! In December of 2020, the HHS announced revisions and clarifications to HITECH in response to Ciox v Azar, providing that opportunity for notice and comment in a Notice of Proposed Rulemaking. The proposed modifications and clarifications even further the limitations on what a provider may charge for records. (YES! Thank you!) The proposal includes:
Boom! HITECH is back my friends.
So, will we be met with fists when the request is a “Third Party Directive?” Well first, this term “This Party Directive” was never defined in HITECH or the Omnibus rules and I personally believe this term was invented by the release of information profit centers as a work around of the fee limitations prior to the Ciox v. Azar ruling. The argument we keep hearing is that when a patient directs records to a third party, the records and then not “for the individual” and therefore, are not a patient access request. Meaning, because the patient wants records sent to someone other than themselves, the patient is not exercising their right to access PHI, but rather, is requesting records for some other purpose. I am not joking; I hear this every single day. Because there are several reasons a patient may ask the records be sent to a third-party (perhaps their new doctor, or their care giver), this argument is severely flawed. So, the OCR took this opportunity in the Notice to clarify the legislative intent of HITECH. The Notice explains that the HITECH Act does not define if a request was made “for the individual.” The clarification provides that the HITECH Act actually expands record exchanges that can be requested by the individual, pursuant to an exercise of their right of access, and the identity of the recipient of the PHI no longer signifies whether the PHI was provided “for the individual” (i.e.; at the individual’s request in an exercise of their rights of access).
Although the OCR is allowing a cost-based fee when an individual uses an internet-based method to direct an electronic copy of PHI in an EMR to a third party, the OCR makes it clear that they expect that in most cases, there will be no allowable labor costs for such access. That’s right, the OCR has finally come out and said it: you cannot charge to drag and drop! Ok, the OCR did not say those words but let’s be honest, we have heard far too many times and seen too many invoices where a provider claims this astronomical effort involved in taking one electronic file and moving it to another folder. No one is buying this nonsense. The medical provider has an EHR or can electronically record health information. The medical provider also has equipment to transfer this electronic information. The assertion that there is no possible way to send the records electronically, claiming that all the records must be printed, copied, and mailed, in the year 2021 is all BS and those days are over. We are present in a world where civilians are planning a trip into space, we have self-driving vehicles and literally almost nothing you cannot purchase online, who could believe such nonsense?
What does this all mean for lawyers? If you were utilizing HITECH to obtain your clients records prior to the Ciox v. Azar case, you may be able to continue doing so once these new proposals and the CURES Act is in play and benefit from the cost-based fee limitations under HITECH. More significant here is that your clients are entitled to their personal health information for FREE when utilizing a personal health record application. As the patient’s representative and fiduciary, it is important to inform your clients of their options and direct them to take control over their own medical records now, for the case, and into the future for whatever purpose. ChartSquad is a personal health record application that provides the means to an end here. Using a PHR such as ChartSquad to access, store, track, and transfer one’s own record provides the patients, your clients, with the control over their health information without suffering at the hands of the profit centers that seek profit off of health information. Technology for the win!