Medical record retrieval firm Ciox Health is suing the Department of Health and Human Services (HHS) for “unlawfully ... and capriciously” restricting the fees healthcare providers and their medical record vendors can charge for gathering and disseminating HIPAA-protected health information.

The fee restrictions threaten to bankrupt medical record providers, according to the lawsuit filed in the Washington, DC, circuit court against Acting HHS Secretary Eric Hargan. The company claims that the $6.50 flat fee established by HHS regulations for electronic copies of PHI is “irrational, arbitrary, capricious, and absurd.”

Ciox Health claims in the lawsuit that changes implemented by HIPAA Omnibus regulations in 2013 and modified in 2016 “threaten to bankrupt the dedicated medical-records providers who service the healthcare industry by effectively and quite deliberately mandating that they fulfill a rapidly growing percentage of requests for protected health information at a net loss.”

The previous regulatory changes broadened the medical information that patients can request transmitted from any form whatsoever “to any third party, including profit-seeking commercial parties like insurers and lawyers.”

But those changes also limited the fees providers can charge for answering a patient’s record request. That puts medical record providers in an untenable position because they must comply with requests, but are not allowed to charge enough to make that service profitable, the lawsuit says.

The process is time-consuming, Ciox Health says, and once the PHI is located, it takes significant effort to fulfill a request for paper or electronic copies of patient medical records in a manner that complies with both federal law and state privacy laws, the company says.

“Producing such information in accordance with these laws is both complex and costly,” Ciox Health alleges in the complaint. “The costs required to fulfill each request for a patient’s PHI include not only the supplies and technology used to produce PHI to the requesting party, but also the extensive labor costs associated with receiving, compiling, verifying, and processing such requests. In many cases, these materials are located in multiple physical and virtual locations, which requires staff to be dispatched to physically obtain or retrieve records from an array of sources.”

The $6.50 flat fee is not the maximum allowed by HHS. The agency’s website explains that $6.50 is established as an option for when the medical records provider does not wish to calculate the actual cost of providing the records.

HHS Guidance issued in May 2016 explains that “$6.50 is not the maximum amount that can be charged for all individual requests for a copy of PHI under the right of access.” The agency adds that “charging a flat fee not to exceed $6.50 is an option available to those entities that do not want to go through the process of calculating the actual or average costs for requests for electronic copies of PHI maintained electronically as permitted by the Privacy Rule.”