Ciox Health, LLC v. Azar - 435 F. Supp. 3d 30 (D.D.C. 2020)

Rule:

The expansion of the Patient Rate in the 2016 Guidance is a legislative rule. "[L]egislative rules are those that grant rights, impose obligations, produce other significant effects on private interests, or . . . effect a change in existing law or policy." Am. Tort Reform Ass'n v. Occupational Safety & Health Admin., 738 F.3d 387, 395, 407 U.S. App. D.C. 398 (D.C. Cir. 2013)  Stated differently, a rule is legislative, and therefore must undergo notice and comment, when it "change[s] the law," Nat'l Res. Def. Council v. EPA, 643 F.3d 311, 320, 395 U.S. App. D.C. 397 (D.C. Cir. 2011), or "effectively amends a prior legislative rule," Am. Min. Cong. v. Mine Safety & Health Admin., 995 F.2d 1106, 1112, 302 U.S. App. D.C. 38 (D.C. Cir. 1993). On the other hand, an agency action that merely "clarifies" the agency's interpretation of the legal landscape and that neither binds the agency nor "create[s] a new burden" on regulated entities is not a legislative rule.  In distinguishing between legislative and non-legislative rules, courts consider both the actual legal effects of the agency action and the agency's characterization of the action, though agencies cannot "avoid notice and comment simply by mislabeling their substantive pronouncements," Azar v. Allina Health Servs., 139 S. Ct. 1804, 1812, 204 L. Ed. 2d 139 (2019).

Facts:

Plaintiff Ciox Health, LLC ("Ciox") is a specialized medical-records provider that contracts with healthcare suppliers nationwide to maintain, retrieve, and produce individuals' protected health information ("PHI"). Ciox handles tens of millions of records requests annually for its clients. Such requests include PHI demands by healthcare providers for treatment purposes, patients asking for their own PHI, and third parties, such as life insurance companies and law firms, seeking a patient's PHI for commercial or legal reasons. This case centers on various legal restrictions and conditions placed on producing PHI. Most significantly, it concerns what a company like Ciox can charge for searching for, retrieving, and delivering PHI. To ensure that patient access to PHI is not thwarted by excessive fees, the United States Department of Health and Human Services ("HHS") has adopted rules that limit what companies may charge for delivering PHI. These restrictions are known as the "Patient Rate." For years, the medical records industry understood that the limitations imposed by the Patient Rate applied only to requests for PHI made by the patient for use by the patient. For other types of requests, such as those made by commercial entities, like insurance companies and law firms, the records industry understood that the allowable fee was not restricted by the Patient Rate. That understanding changed, however, in 2016, when HHS issued a guidance document, which stated that the Patient Rate applies even to requests to deliver PHI to third parties. This change, according to Ciox, caused Ciox and other medical records companies to lose millions of dollars in revenue. Ciox challenges the 2016 expansion of the Patient Rate as violative of the procedural and substantive protections of the Administrative Procedure Act ("APA"). In addition to the scope of the Patient Rate, Ciox also contested two additional pronouncements made by HHS in the 2016 guidance document. The first addresses the types of labor costs that are recoverable under the Patient Rate. The second concerns three alternative methods identified for calculating the Patient Rate. Ciox argued that these actions violate the APA's procedural and substantive provisions. Ciox also challenged under the APA a regulation adopted in 2013, which requires records companies to send PHI to third parties regardless of the format in which the PHI is contained and in the format specified by the patient. According to Ciox, Congress required only that certain types of electronic health records be delivered to third parties, not all records regardless of their format, as HHS's regulations now command. Before the court is HHS's motion to dismiss and the parties' cross-motions for summary judgment.

Issue:

Were the 2016 Patient Rate expansion and the 2013 mandate broadening PHI delivery to third parties regardless of format lawful?

Answer:

No.

Conclusion:

HHS's motion to dismiss is granted in part and denied in part, and the parties' cross-motions are granted in part and denied in part. The court rejected the agency's grounds for dismissal in all respects, except one: the court found that the agency's three methods for calculating the Patient Rate is not a reviewable final agency action. That claim was thus dismissed. As for the parties' cross-motions, the court holds that: (1) HHS's 2013 rule compelling delivery of PHI to third parties regardless of the records' format was arbitrary and capricious insofar as it goes beyond the statutory requirements set by Congress; (2) HHS's broadening of the Patient Rate in 2016 is a legislative rule that the agency failed to subject to notice and comment in violation of the APA; and finally, (3) HHS's 2016 explanation concerning what labor costs can be recovered under the Patient Rate is an interpretative rule that HHS was not required to subject to notice and comment. Accordingly, the court declares unlawful and vacates (1) the 2016 Patient Rate expansion and (2) the 2013 mandate broadening PHI delivery to third parties regardless of format.