A Missouri federal court granted a motion to dismiss this week in a case against a provider and medical record processing company. In the case, a patient alleged that a “search and retrieval” fee imposed in response to a patients request for access to medical records violated the Missouri Merchandizing Practices Act. In dismissing the claim, the court only addressed Missouri law as the allegations did not involve alleged violations of HIPAA. The outcome in this Missouri case is similar to the outcome in an unrelated Tennessee case against the same medical records company that was dismissed earlier this summer. The Tennessee case alleged multiple violations of Tennessee law relating to the fees imposed for access to medical records, using HIPAA as the standard for medical records fees. In dismissing the case, the Tennessee court found that neither HIPAA nor Tennessee law provide a private cause of action for excessive medical record fees. The Tennessee case is pending appeal.
It is important to note that, while both of these cases held that there were no damages available to the patient for excess medical record fees, neither case addressed the permissibility of the fee under HIPAA. When a patient requests access to medical records under HIPAA, the provider is permitted to charge a cost-based fee that includes the labor to copy the records and related supplies. The Office for Civil Rights has repeatedly taken the position that, because the costs that can be charged for access only include copying the records, providers are prohibited from including the cost of gathering or preparing the record. The guidance, and related FAQs, specifically indicate that, related to access, the provider may only bill the lesser of what is permitted under state law or HIPAA.
The full guidance is available at https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html.
This latest case is a win for Missouri providers to prevent additional damages under Missouri law associated with medical record fees. However, like other cases that have been dismissed in federal court because HIPAA does not provide a private cause of action, this case has no impact on compliance obligations under HIPAA and does not prevent the patient from filing a complaint with the Office for Civil Rights, which can result in a regulatory investigation and potential fines and penalties.
This blog post was drafted by Donn Herring, a Partner in the St. Louis, MO office of Spencer Fane LLP. For more information, visit spencerfane.com.
