Contributing Professional

Kara J. Kelly

the Topic

How Ciox v. Azar is Shaping HiTech Requests for Lawyers

The decision made in the United States District Court for the District of Columbia (Ciox Health, LLC v. Azar, Case No. 18-cv-00040) sent a bit of a shockwave through the legal system, most notably the personal injury area of practice.

How did the Ciox v. Azar decision impact injury attorneys and their ability to obtain medical records via HITECH letter?

The ruling caused the US Department of Health and Human Services (HHS) to modify its interpretation of the HiTech Act. Originally, HHS provided guidance that patient requests for medical records can be directed to providers and require them to send their private records to third parties, regardless of who they are. This meant a patient can have their records sent to their attorney, a 3rd party retrieval company, or even their neighbor if they chose.

The real battle; however, was over the fees that they could charge for the records. Ciox and other medical record storage providers who worked with hospitals wanted to be able to charge fees beyond what was allowed under patient directed requests. Under HIPAA, fees that a covered entity may impose” must be “a reasonable, cost-based fee,” provided the fee only consists of the actual cost of labor for copying, supplies for creating the record (ie. paper of cd), and postage (see 45 CFR § 164.524 (4)(i)-(iv) and CFR § 164.524(c)(4)).

Therefore, a provider who is sending medical records on a patient directive is allowed to charge:

  1. A reasonable fee (see 45 CFR § 164.524 (4)(i)-(iv))
  2. Limited to their actual costs (see 45 CFR § 164.524 (4)(i)-(iv))
    1. Made up of only:
      1. actual cost of labor for copying (see 45 CFR § 164.524 (4)(i))
      2. supplies for creating the record (ie. paper of cd) (see 45 CFR § 164.524 (4)(ii)), and
      3. postage ((see 45 CFR § 164.524 (4)(iii))

Now, there is no dispute that this is the law of the land and the companies that are in the business of selling access to medical records know that. What they did dispute was whether or not attorneys and other 3rd party retrieval companies working on behalf of the patient were entitled to pay the same amount as the patient themselves. The court said “no!” and shortly thereafter HHS released the following information on its website:

“On January 23, 2020, a federal court vacated the “third-party directive” within the individual right of access “insofar as it expands the HITECH Act’s third-party directive beyond requests for a copy of an electronic health record with respect to [protected health information] of an individual  . . . in an electronic format.” Additionally, the fee limitation set forth at 45 C.F.R. § 164.524(c)(4) will apply only to an individual’s request for access to their own records, and does not apply to an individual’s request to transmit records to a third party.”

It appears that Ciox won the battle and limited the coverage of who was allowed the “reasonable, cost-based fee” to only the patient themselves when they want to access their own record.

You may ask yourself if this will impact you since it was only a district court and was in Washington, DC. The answer to that is, unfortunately, yes. When a federal agency’s regulations are challenged in Washington DC, it results in the invalidity of the regulation. However, it does not immediately vacate it. Instead, the issue at hand is sent back to the agency for them to consider and adjust. Therefore, HHS will have the ability to decide whether or not they want to challenge this, adjust their regulation to comply with the courts guidance, or simply accept it.


There is no indication as of the time of this article as to whether or not HHS will appeal the decision. However, the agency has already modified its website in many ways that clearly show compliance and acceptance of the courts decision.

What are the new rules after the ciox decision

How does the Ciox decision impact personal injury attorneys?

Well, for starters, this means a decision has to be made. The DC District Court’s decision essentially left attorneys with two options.

  1. The firm can have the client request their own medical records and have them be responsible for returning the records and ensuring they are complete and what was actually requested.
  2. The firm can continue to obtain 3rd party authorizations (Directives) and pay for the records on the clients behalf, as most do now.

How can Attorneys respond to the new Ciox Decision?

Option 1. Clients Start Requesting their own Medical Records.

The pre-existing HITECH letters can still be a great way for plaintiffs to reduce the cost of medical records by requesting them in electronic form from the provider (the provider can still adopt the $6.50 safe harbor). Implementing a system where the client is responsible for the request, review, and payments of medical records may work in some boutique firms; however, it is likely to cause enormous problems for most plaintiff’s attorneys and ultimately, is very likely to delay cases and negatively impact the client.

Attorneys will still need to provide guidance on how to submit these requests, where they should go, and what to expect. However, the firms will also need to be aware that the patient will need to pay for the records. As all Personal Injury lawyers know, a good number of injured people struggle to keep up with finances, which means access to the medical records could be difficult (State law may be able to help you out here).

In situations where the client cannot afford to pay for the records, the lawyer may have an option to collect and review the bills and pay on the client’s behalf to be reimbursed later. However, this will likely prove to be an administrative nightmare because the firms will now need tracking systems for both payments on behalf of clients and then follow-up on records themselves.

Thoughts from an attorney on option 1:

Are there any Legal Ethics Implications in paying for records not intended for use by the firm?


Michael P. Earner, Esq.

It is unclear of this type of relationship of providing money to your client to cover the cost of medical records requires additional consideration of legal ethics rules. There is a rule in every state that talks about business transactions between attorneys and clients. In this scenario, essentially, the lawyer is loaning money to the client to obtain the medical records. There is an argument that there is a unique distinction here because even though this is essentially a case cost, the attorney/firm is not entitled to the record themselves at that rate under the new interpretations. So, although the medical records are a part of the case, and necessary. Is the direct payment on behalf of the client a loan to the client that is outside of the normal case expense? It may be a bit of a stretch and I don’t think it is; however, attorneys should be aware of the limitations and requirement outlined in Model Rule 1.8 (or your state equivalent). In the ABA comments on Rule 1.8, it outlines that “Paragraph (a)(1) requires that the transaction itself be fair to the client and that its essential terms be communicated to the client, in writing, in a manner that can be reasonably understood. There is no doubt that a lawyer advancing money to the client to retrieve medical records to further their case is fair, so the first part is passed. However, the second part requires that the terms be written and easily understood. This can be met by simply adding additional language to the fee agreement such as “throughout the course of this matter, I may advance money to cover the cost of medical records you request to assist with your case. This is considered to be part of the case expenses and will be repaid in the same manned outlined above.”

Seems pretty straightforward. However, Paragraph (a)(2) also requires that the client also be advised, in writing, of the desirability of seeking the advice of independent legal counsel and it also requires that the client be given a reasonable opportunity to obtain such advice.

Now, I am not saying this type of arrangement definitely runs afoul of the rules. However, it may be prudent to obtain ethics advice if you have concerns. You wouldn’t loan your client money to pay a car note, why would you loan them money to obtain medical records intended for their personal use?


Option 2. Attorneys continue to own the Process of Requesting Medical Records on their clients behalf.

This will allow the attorneys to continue to move the cases forward and control the financial aspect of the situation. However, there needs to be some consideration given because this will surely result in a higher amount being billed for the records, but could also prove to be the most efficient way to actually take care of the client and ultimately resolve their case.

Does state law still apply after the Ciox v. Azar decision?

The answer is yes. HIPAA was never intended to overrule state laws where the state has more strict requirements than the federal government. The decision only applies to the US Department of HHS regulatory guidance and interpretation of the federal law. However, the states themselves still need a statute that is applicable. A state can easily pass a state level “HITECH Act” that includes a third-party mandate.

Can attorneys do anything to avoid paying higher fees after the Ciox decision?

We have met with several attorneys who have come up with possible ways to overcome this through crafty thought. Here are a couple of the best ones.

  1. Crafty Thought #1 – Can’t we simply have the records sent to the client c/o our firm?

Of course, you could. However, it is very likely that the covered entities will simply adopt the old adage – If it walks like a duck and quacks like a duck, it must be a duck. It is very unlikely that will do anything to stop them from charging the higher level fees.

  1. Crafty Thought #2 – Can’t we just have the records sent to a PO Box?

We suspect this could work, for a time, at least. However, there is no doubt that the providers will catch on to this and re-implement their duck sentiments. Most big record providers, like Ciox, MRO, ChartSwap, IOD and others will start to see this happening and put a stop to it pretty quickly. Also, this one may be a little deceptive on behalf of the crafty lawyer. We don’t recommend it.

How can attorneys protect the client’s money and case expenses after Ciox v. Azar?


There is no argument against the fact that resolving the case for the client and allowing them to begin to move forward in life is what is in the best interest of the client. There are a few things attorneys can do to help control costs and advance the matter as expeditiously as possible.

How much do medical records cost?
Things you can do:
  1. Limit the request to only what is needed for the suit. We have heard horror stories of attorneys requesting “any and all” records of a client. Most providers charge some sort of retrieval and per page fee. Limiting to what you actually need is one of the best ways to control costs, no matter which route you take.
  2. Keep your signed authorizations and cover letters consistent. We have seen situations where the cover letter requests “medical records” and the actual authorization is for bills. Providers will sometimes send both and try to stick you with the bill. Ensuring you are consistent and paying attention to detail will pay off for sure.
  3. Always limit what you are willing to pay by putting a pre-authorized ceiling on the cover letter. You can do this by requesting to be notified of the amount “if the total cost is over” a certain threshold. Many providers will send the records and the invoice simultaneously. By including this limitation in your cover letter, you at least have something to fall back on when they try to stick you with the bill.
  4. Provide Clients a Pre-Paid Envelope. If you choose to have your clients request the records themselves, it may be a good idea to provide them with a pre-paid stamped envelope for them to send you the records once they come in. Of course, it still requires the client to be somewhat trustworthy and responsible, but it may increase your chances of actually getting the records back.
  5. Develop a system to track, review, and pay for the record requests (or hire a highly efficient 3rd party provider like Total Trial Solutions to do it for you). This will allow you to a) ensure you are receiving what you actually requested and are not being charged for more or less than you need, b) quickly know which records you have and still need, and c) allow you to move your clients case forward and allow them the peace of mind to continue to recover their lives after their injuries or losses.
Medical Records Retrieval

About the Author

Kara has lived in many states around the country, but has been a resident of the Hudson Valley region of New York since she was 15 years old. Kara has spent much of her career working in office administration. She is the Medical Records Department Supervisor at Total Trial Solutions, but continues to keep her medical administration skills up-to-date working part-time in the emergency room at a local hospital. With her medical office experience, Kara is responsible for training new retrieval specialists and keeping up with ever changing patient right laws. In her free time, Kara enjoys shopping, going to the gym, and spending time with her daughter and the rest of her family. She also loves traveling, especially to destinations with bright sandy beaches.

Explore More From Our Contributing Authors

Skip to content