Quentin White v. Henry Ford MacOmb Hospital Corporation

If this opinion indicates that it is “FOR PUBLICATION,” it is subject to revision until final publication in the Michigan Appeals Reports.

STATE OF MICHIGAN

COURT OF APPEALS

QUENTIN WHITE, FOR PUBLICATION April 20, 2023 Plaintiff-Appellant, 9:05 a.m.

v No. 360302 Macomb Circuit Court HENRY FORD MACOMB HOSPITAL LC No. 2021-001284-PD CORPORATION and MRO CORPORATION,

Defendants-Appellees. Before: GARRETT, P.J., and K. F. KELLY, and HOOD, JJ.

HOOD, J.

Plaintiff, Quentin White (White), appeals as of right the order of the trial court granting summary disposition in favor of defendant Henry Ford Macomb Hospital Corporation (Henry Ford). We affirm in part, reverse in part, and remand for further proceedings.

I. BACKGROUND

This case started with a medical-record request that White sent to Henry Ford, asking Henry Ford to send medical records to his attorneys. This case is about the proper fees and timing associated with Henry Ford’s and defendant MRO Corporation’s (MRO)1 response to that request.

This case involves several provisions under the Michigan Medical Records Access Act (the MRAA), MCL 333.26261 et seq., the Health Insurance Portability and Accountability Act (HIPAA), 42 USC 1320d et seq., and the Health Information Technology for Economic and Clinical Health Act (the HITECH Act), 42 USC 17901 et seq. It also involves regulations and guidance related to HIPAA and the HITECH Act. Most notably, the 2013 regulations from the United States Department of Health and Human Services (HHS), referred to as the 2013 Omnibus Rule, as well as a document entitled, “Individuals’ Right under HIPAA to Access to Health

1 We refer to Henry Ford and MRO collectively as “defendants.”

-1-

Information 45 CFR 164.524,” also referred to as the 2016 Guidance. We provide an overview of the statutory and regulatory framework in Section III below.

In late December 2020, White was injured in a motor vehicle accident. After the accident, he received medical treatment at Henry Ford. White wanted to file a claim against the at-fault driver, so he retained an attorney. And, as he indicated in his records request, to “properly pursue his personal injury claim, [he] needed his medical record from Henry Ford.” So, on February 1, 2021, White signed a record request, labeled “HITECH RECORD REQUEST,” asking Henry Ford to send his medical record to his attorney, Brent Sitto. The request explicitly asked that Henry Ford provide the records “in electronic format only using Adobe Acrobat pdf format.”

MRO is a medical records provider that contracts with healthcare suppliers, like Henry Ford, to maintain, retrieve, and produce individuals’ protected health information. White sent his record request to Henry Ford on February 2, 2021. Some time between February 2, 2021, and February 3, 2021, Henry Ford forwarded the request to MRO. On February 3, 2021, MRO generated two letters related to White’s record request. The first letter, to Sitto, indicated that MRO was processing the request on Henry Ford’s behalf. At the bottom of the letter, MRO, under a heading entitled, “HITECH Rate Dispute,” referenced the January 2020 decision of the United States District Court for the District of Columbia in Ciox Health, LLC v Azar, 435 F Supp 3d 30 (DDC, 2020). According to MRO’s summary, the Ciox decision vacated the portion of HHS’s 2016 Guidance that “allow[ed] patients to direct medical records to 3rd parties such as your organization, for the same discounted rate allowed to [the] patient . . . .”

MRO addressed the second letter, which confirmed receipt of the record request, to Sitto. It indicated that Henry Ford was “in the process of searching for and retrieving a copy of the requested records” and that, if there were no issues with the request, MRO would send Sitto a “pre- payment invoice.” The letter also explained that MRO would send the records to Sitto “upon receipt of your payment.” The invoice, however, was also generated on February 3, 2021, the same day as MRO’s two letters to Sitto. At the top of the invoice it states: “PREPAYMENT REQUIRED[.]” The invoice indicated that there were 26 pages of records. The balance due under the invoice was $54.56, which included a $25.38 search-and-retrieval fee, $25.40 for “Tier 1” pages printed and $3.78 for “Tier 2” pages printed.

From February 2, 2021 until March 10 2021, neither White nor his attorneys responded to the letters. On March 10, 2021, Sitto sent a letter to MRO addressing its letters regarding White’s record request. Sitto’s letter noted that White’s HITECH record request “was received by your office on 2-2-2021.” Sitto indicated that, on March 2, 2021, he or his law firm received MRO’s notice about the record request. Sitto quoted language from federal regulations he claimed were applicable, including 45 CFR 164.524(b) and (c)(3)(i). Sitto asserted that MRO had to provide the records within 30 days of February 2, 2021, i.e., by March 4, 2021. Sitto indicated it had been over 30 days and, as a result, MRO was “now subject to penalties for violation of federal law.” In the same letter, Sitto rejected MRO’s reliance on Ciox and asserted that MRO could only charge $6.50 under the HITECH Act. He asked MRO to forward the records and “an invoice for $6.50 maximum.”

In mid-March 2021, MRO faxed a letter regarding White’s record request to Sitto. MRO reiterated that the provisions Sitto relied on to argue for the $6.50 fee no longer applied. MRO

-2-

indicated that White and Sitto were “invoiced correctly under HIPAA, HITECH and applicable state law” and that the fee limitations from the HITECH Act only applied to requests from individuals, not third parties, including law firms or situations where “the patient’s medical records are being requested to be sent to a third party.” The letter also reiterated that MRO would provide the requested copies of records “[u]pon payment of the balance due on the invoice.”

Less than a month later, White sued defendants, raising four claims: (1) unlawful detention, and recover possession, of medical records under MCL 600.2920; (2) claim and delivery (replevin) under MCR 3.105; (3) common-law conversion; and (4) declaratory relief, asking the court to determine (a) the applicability of the HITECH Act, (b) the amount defendants could properly charge White, and (c) any other determination necessary to adjudicate the case. The essence of White’s claims was that defendants improperly withheld his medical records and he sought to “recover possession” of those records. He alleged that defendants’ failure to provide his records impeded his “ability to expeditiously prosecute his injury claims . . . .” White amended his complaint in late May 2021, adding a fifth claim: violation of the Michigan Consumer Protection Act (MCPA), MCL 445.901 et seq. Under this new claim, White alleged that defendants charged him a fee “grossly in excess of the price at which similar property or services are sold.”

In mid-June 2021, Henry Ford’s attorney e-mailed White’s records to Sitto in PDF format. According to MRO on appeal, this was done “at no-charge” and “to resolve the issue and avoid” litigation costs.

In mid-August 2021, MRO moved for summary disposition of White’s claims under MCR 2.116(C)(8) and (10). MRO argued that it was not limited to charging a maximum of $6.50 for the requested records, because, after Ciox, that fee limitation did not apply. It also argued that its invoice was proper under the MRAA, which also allowed it to withhold White’s records pending payment. MRO further argued that because White requested his records for litigation purposes, his MCPA claim failed as a matter of law under Slobin v Henry Ford Health Care, 469 Mich 211; 666 NW2d 632 (2003). Henry Ford concurred in MRO’s motion.

White responded, arguing that MRO failed to comply with federal law when it did not act on his record request within 30 days. He also argued that MRO ignored his request for electronic records and improperly charged the state law rate for paper copies. White further argued that MRO’s reliance on Ciox was misplaced, and that the prepayment requirement under MCL 333.26269(2) conflicted with the HITECH Act and was, therefore, federally preempted. And White asserted that because he requested his record “for personal purposes for his personal injury claim,” this case was distinguishable from Slobin and, thus, he had a valid MCPA claim.

After a hearing, the trial court issued an opinion and entered an order granting summary disposition to defendants. The court first found that because an attorney is a third party under the applicable statutory scheme, MRO could properly charge them above the Patient Rate. It also noted that the Ciox court vacated the 2013 Omnibus Rule and 2016 Guidance. It also found that White had failed to establish that Henry Ford kept its records in a form other than paper, as required for MCL 333.26269(1)(c) to apply, despite his argument that MRO’s invoice was improper because he asked for electronic records. The trial court further found that MRO’s fees were reasonable, and that the HITECH Act and related regulations did not prohibit withholding records

-3-

until prepayment of a fee, as allowed under the MRAA. And the court found that Slobin precluded White’s MCPA claim because he had requested the records for litigation purposes.

White moved for reconsideration. He argued that the trial court prematurely granted summary disposition before the parties completed discovery. His overarching argument was that, as it related to Henry Ford, there was a factual dispute regarding whether its medical records were kept in a form other than paper, such that MCL 333.26269(1)(c) applied. He asserted that discovery on that issue likely would resolve the dispute, noting that had the trial court not granted MRO’s dispositive motions, Henry Ford or MRO could comply with discovery orders related to producing various documents and representatives. At the hearing on the motion, the trial court acknowledged that it “should have waited until” after the deposition of Henry Ford’s representative to evaluate whether summary disposition was appropriate with respect to Henry Ford. Accordingly, the court entered an order granting in part and denying in part White’s motion for reconsideration, setting aside the grant of summary disposition as it related to Henry Ford, but denying the motion as it related to MRO.2

Henry Ford complied with the discovery orders and produced its keeper of records, Veeta Montgomery, for a deposition. Thereafter, Henry Ford moved for summary disposition under MCR 2.116(C)(8) and (10). It argued that White had failed to establish a factual dispute regarding whether MRO’s fee was improper. Focusing on the MRAA and MCL 333.26269(1)(c), Henry Ford argued that the Patient Rate was “limited to requests made by the patient for personal medical use” and, therefore, any request outside those parameters was “not covered” and “left to the states.” It also argue that White’s MCPA claim failed because of Slobin.

After White responded, mirroring many of his arguments in his response to MRO’s dispositive motion, and a hearing, the trial court issued an opinion and order granting summary disposition to Henry Ford. The court found that the Patient Rate did not apply because White’s request was “made by a third-party.” It also found that there was no genuine factual dispute regarding the reasonableness of the fees charged. This appeal followed.

II. STANDARD OF REVIEW

This Court reviews de novo a trial court’s decision on a motion for summary disposition. El-Khalil v Oakwood Healthcare Inc, 504 Mich 152, 159; 934 NW2d 665 (2019). “A motion under MCR 2.116(C)(8) tests the legal sufficiency of a claim based on the factual allegations in the complaint.” Id. 159 (emphasis omitted). “When considering such a motion, a trial court must accept all factual allegations as true, deciding the motion on the pleadings alone.” Id. at 160. “A motion under MCR 2.116(C)(8) may only be granted when a claim is so clearly unenforceable that no factual development could possibly justify recovery.” Id.

A motion under MCR 2.116(C)(10) “tests the factual sufficiency of a claim.” El-Khalil, 504 Mich at 160 (citation and emphasis omitted). In considering a motion under MCR 2.116(C)(10), the trial court “must consider all evidence submitted by the parties in the light most

2 The trial court amended the order regarding reconsideration to include additional language making it clear that it had reinstated the case.

-4-

favorable to the party opposing the motion.” Id. (citation omitted). Such a motion “may only be granted when there is no genuine issue of material fact.” Id. (citation omitted). “A genuine issue of material fact exists when the record leaves open an issue upon which reasonable minds might differ.” Id. (quotation marks and citation omitted).

We review de novo questions of statutory interpretation. Yopek v Brighton Airport Ass’n, Inc, ___ Mich App ___, ___; ___ NW2d ___ (2022) (Docket No. 359065); slip op at 3 (citation omitted).

The goal of statutory interpretation is to determine and apply the intent of the Legislature. The first step in determining legislative intent is to examine the specific language of the statute. If the language is clear and unambiguous, judicial construction is neither required nor permitted, and courts must apply the statute as written. The provisions of a statute must be read in the context of the entire statute to produce a harmonious whole. This Court must consider the object of the statute and the harm it is designed to remedy, and apply a reasonable construction that best accomplishes the statute’s purpose. [Id. at ___; slip op at 4-5 (quotation marks and citations omitted).]

III. OVERVIEW OF THE STATUTES AND REGULATIONS GOVERNING MEDICAL RECORD REQUESTS

This case requires an understanding of the interplay between the HITECH Act, HIPAA, related federal regulations, the MRAA, and the effect of the Ciox decision on this case.3 We, therefore, begin by reviewing the statutory and regulatory framework applicable to medical record requests at issue in this appeal.

A. HIPAA AND THE PRIVACY RULE

Congress passed HIPAA in 1996 with the explicit purpose to “encourag[e] the development of a health information system.” Ciox, 435 F Supp 3d at 38-39. It tasked the United States Department of Health and Human Services (HHS) with recommending regulatory standards related to protected health information, including regulations concerning an individual’s right to access their protected health information. Id. (citations omitted). In 2000, HHS issued the “Privacy Rule,” which established an individual’s right to access their medical records. Id.; see 45 CFR 164.524. It also established the fees that a “covered entity,”4 such as a hospital, could charge for production of those records. Ciox, 435 F Supp 3d at 39; see 45 CFR 164.524. If an

3 Although not binding on state courts, lower federal court decisions may be considered for their persuasive value. Abela v Gen Motors Corp, 469 Mich 603, 607; 677 NW2d 325 (2004). Although Ciox has no precedential effect, its holding bears on the validity of the federal regulations at issue in this case. 4 A “covered entity” includes “health plans, health care clearinghouses, and health providers that “transmit[ ] any health information in electronic form in connection with a [covered] transaction.” Ciox, 435 F Supp 3d at 39, quoting 45 CFR 160.103.

-5-

individual requests their own protected health information, also known as a “personal use request,” the Privacy Rule allows a covered entity to “charge a reasonable, cost-based fee.” Ciox, 435 F Supp 3d at 39. See 45 CFR 164.524(c)(4). The Ciox court referred to this “reasonable, cost-based fee” as the “Patient Rate.” Ciox, 435 F Supp 3d at 39. As originally enacted, the Privacy Rule provided that the Patient Rate could include the following elements: (1) the cost of copying the protected health information, including the cost of supplies and labor for copying; (2) preparing an explanation or summary of the protected health information; and (3) postage, if the individual requests that the copy, summary, or explanation be mailed. Id.

In addition to regulating “covered entities,” the Privacy Rule also regulates “business associates”5 (though to a lesser extent than covered entities). Ciox Health, LLC, 435 F Supp 3d at 39. Under the definitions of “covered entity” and “business associate,” Henry Ford is a covered entity (a health provider) and MRO is a business associate (offering health records to patients on Henry Ford’s behalf).

The purpose of the Privacy Rule was to ensure individuals would not be deterred by cost when seeking protected health information. See Ciox Health, LLC, 435 F Supp 3d at 40, citing Standards for Privacy of Individually Identifiable Health Information, 65 Fed Reg 82,577 (December 28, 2020). But if the cost of obtaining and transmitting the health information was borne by someone other than the patient, HHS did not require the Patient Rate. See id. (quoting language from 65 Fed Reg at 82,577 indicating that HHS did “not intend to affect the fees that covered entities charge for providing protected health information to anyone other than the individual.”). See also id., quoting 65 Fed Reg at 82,754 (“The proposal and the final rule establish the right to access and copy records only for individuals, not other entities; the ‘reasonable fee’ is only applicable to the individual’s request.”). This demonstrates a distinction between protected health information requested by a patient and such information requested by a non-patient. Id. The Patient Rate applies to protected health information requested by a patient, but not a non- patient. Id. HHS’s “expectation [was] that other existing practices regarding fees, if any, for the exchange of records not requested by an individual will not be affected by” the Privacy Rule. Ciox Health, LLC, 435 F Supp at 40, quoting 65 Fed Reg at 82,754.

B. THE MICHIGAN MEDICAL RECORDS ACCESS ACT

In 2004, our Legislature passed the MRAA, which, in relevant part, provides a fee schedule for medical record requests that are not covered by the Patient Rate. See MCL 333.26269(1). The fee schedule is updated on an annual basis. See MCL 333.26269(6). The MRAA also includes a provision allowing record providers to require prepayment of an applicable fee before sending requested records: “A health care provider, health facility, or medical records company may refuse

5 Generally, a “business associate” operates on the covered entity’s behalf and “creates, receives, maintains, or transmits protected health information for a [regulated] function or activity.” Id. (quotation marks and citation omitted). “Business associates include a ‘person that offers a personal health record to one or more individuals on behalf of a covered entity’ and a ‘subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate.’ ” Ciox Health, LLC, 435 F Supp 3d at 39.

-6-

to retrieve or copy all or part of a medical record for a patient or his or her authorized representative until the applicable fee is paid.” MCL 333.26269(2).

C. THE HITECH ACT

In 2009, Congress passed the HITECH Act. Ciox Health, LLC, 435 F Supp 3d at 40. Two provisions of the HITECH Act are particularly relevant here, 42 USC 17935(e)(1) and (3). See id. at 40-41. With 42 USC 17935(e)(1), Congress created the “third-party directive,” which simplified the “process for requesting delivery of certain [protected health information] to third persons.” Id. at 40. “Under the pre-2009 Privacy Rule, a covered entity” could not release protected health information “stored in any format to a third party” absent “valid authorization.” Id. Obtaining that authorization was burdensome, and the HITECH Act “stripped away these requirements” as it related to electronic health records.6 42 USC 17935(e)(1) provides:

In applying [45 CFR 164.524],[7] in the case that a covered entity uses or maintains an electronic health record with respect to protected health information of an individual—

(1) the individual shall have a right to obtain from such covered entity a copy of such information in an electronic format and, if the individual chooses, to direct the covered entity to transmit such copy directly to an entity or person designated by the individual, provided that any such choice is clear, conspicuous, and specific[.] [Footnote added.]

“So, with respect to [protected health information] contained in an [electronic health record], the HITECH Act expressly entitles patients to obtain such information for themselves or to direct the information to a third party, without the need for a ‘valid authorization’ under the Privacy Rule.” Ciox Health, LLC, 435 F Supp 3d at 41.

With 42 USC 17935(e)(3), Congress imposed a statutory limit on the fee a covered entity could charge a patient for delivering any electronically-held information. Ciox Health, LLC, 435 F Supp 3d at 41. 42 USC 17935(e)(3) provides:

[N]otwithstanding [45 CFR 164.524(c)(4) (providing allowable fees for labor, supplies, and postage)],[8] any fee that the covered entity may impose for providing

6 An “electronic health record” is “an electronic record of health-related information on an individual that is created, gathered, managed, and consulted by authorized health care clinicians and staff.” 42 USC 17921(5). 7 White asserts that 45 CFR 164.524(b)(2)(i) is particularly relevant here. He argues that, under that subsection of the regulation, defendants had 30 days to act on his record request. The language of that particular regulation is provided in Section IV.A. of this opinion. 8 White asserts that 45 CFR 164.524(c)(3)(i) and (4) are also relevant here. He argues that 45 CFR 164.524(c)(4), entitled “Fees,” does not indicate that entities can require prepayment of a fee and that, under 45 CFR 164.524(c)(3)(i), the entity must provide access in a timely manner.

-7-

such individual with a copy of such information (or a summary or explanation of such information) if such copy (or summary or explanation) is in an electronic form shall not be greater than the entity’s labor costs in responding to the request for the copy (or summary or explanation). [Footnote added.]

The Ciox court indicated that, “[a]s the plain text makes clear, the HITECH Act’s fee cap applie[d] at least to personal use requests produced as [electronic health records].” Ciox Health, LLC, 435 F Supp 3d at 41. “Whether the statutory fee cap extend[ed] beyond such demands [was] the subject of dispute” at issue in Ciox. Id.

D. THE 2013 OMNIBUS RULE AND THE 2016 GUIDANCE

In 2013, HHS issued the 2013 Omnibus Rule, a broad set of regulations amending the Privacy Rules. Ciox Health, LLC, 435 F Supp 3d at 41. One particular amendment expanded the third-party mandate to include records in any format, not just electronic health records. Id. See Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules, 78 Fed Reg 5,631 (January 25, 2013). In expanding the third-party mandate, HHS recognized it was “going beyond the text of the HITECH Act” and conceded that the HITECH Act “ ‘applie[d] by its terms only to protected health information in [electronic health records].” Ciox Health, LLC, 435 F Supp 3d at 41, quoting 78 Fed Reg 5,631. The 2013 Omnibus Rule also amended the portion of the Privacy Rule that specified the costs recoverable under the Patient Rate, and when that rate applied. Ciox Health, LLC, 435 F Supp 3d at 42. It “broke out, as part of the reasonable cost-based fee, the cost of labor for copying [protected health information], whether in paper or electronic format,” which could include time spent by skilled technical staff to create and copy electronic files. Id. (citations omitted). But the actual cost of labor “associated with the retrieval of electronic information” was not recoverable under the Patient Rate, nor were fees associated with maintaining systems, data access, storage, and infrastructure. Id. (quotation marks and citations omitted).

Then, in 2016, HHS issued the 2016 Guidance. Particularly relevant here, HHS, through the 2016 Guidance, declared that the Patient Rate applied “when an individual directs a covered entity to send the [protected health information] to a third party.” Ciox Health, LLC, 435 F Supp 3d at 42 (citation omitted). In other words, the Patient Rate applied “regardless of whether the individual ha[d] requested that the copy of [protected health information] be sent to herself, or has directed that the covered entity send the copy directly to a third party designated by the individual (and it doesn’t matter who the third party is).” Id. (quotation marks and citations omitted). The 2016 Guidance also noted that the Patient Rate did not apply when the third party initiated a request for protected health information on its own behalf, with the individual’s HIPAA authorization. Id. (citation omitted). HHS stressed, however, that when the third party forwarded the individual’s record request for a covered entity to send a copy of the protected health information to the third party (on the individual’s behalf and at their direction), the fee limitations applied. Id. (citation omitted).

The 2016 Guidance also gave direction for determining the Patient Rate. Ciox Health, LLC, 435 F Supp 3d at 43. It limited the Patient Rate to labor costs incurred after the protected health information requested was identified, retrieved, and compiled, and was ready to be copied.

-8-

Id. (citations omitted). The 2016 Guidance also provided three alternatives for calculating the reasonable, cost-based fee that could be charged when a patient initiated a protected-health- information request, and that applied to a covered entity or business associate. Id. (citation omitted). The holder of protected health information could determine the fee by (1) calculating actual allowable costs for fulfilling each request; (2) using a schedule of costs based on average allowable labor costs in fulfilling standard requests; or (3) in cases involving requests for electronic copies of protected health information maintained electronically, covered entities could charge a flat fee not to exceed $6.50 (which includes all labor, supplies, and postage). Id. (citations omitted). The third option, the flat fee not to exceed $6.50, was an option available to entities that did not want to “go through the process of calculating actual or average allowable costs for requests for electronic copies of [protected health information] maintained electronically.” Id. (quotation marks and citation omitted).

E. CIOX HEALTH, LLC V AZAR

In Ciox Health, LLC v Azar, the United States District Court for the District of Columbia vacated the 2016 Guidance to the extent that it extended the Patient Rate to third-party directive requests. See Ciox Health, LLC, 435 F Supp 3d at 68-69 (addressing challenges to the 2013 Omnibus Rule and 2016 Guidance under the Administrative Procedure Act, 5 USC 706). The court stated:

The HITECH Act on its face applies the Patient Rate only to individual requests for [protected health information] in electronic form, and the 2013 Omnibus Rule says nothing at all about the Patient Rate’s application. Indeed, the 2016 Guidance represents an about-face from HHS’s proclamation, made in 2000 when it first adopted the Privacy Rule and the Patient Rate, that “[w]e do not intend to affect the fees that covered entities charge for providing protected health information to anyone other than the individual,” 65 Fed Reg at 82,557 (emphasis added), and “[t]he proposed and final rule establish the right to access and copy records only for individuals, not other entities; the ‘reasonable fee’ is only applicable to the individual’s request,” id. at 82,754 (emphasis added); see also id. (“The Department’s expectation is that other existing practices regarding fees, if any, for the exchange of records not requested by an individual will not be affected by this rule.”). [Id. at 66-67.]

And in late January 2020, HHS issued a statement regarding the guidelines and the effect of the Ciox decision, stating:

On January 25, 2013, HHS published a final rule entitled “Modifications to the HIPAA Privacy, Security, and Enforcement Rules Under the Health Information Technology for Economic and Clinical Health Act, and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules.” (2013 Omnibus Rule). A portion of that rule was challenged in federal court, specifically provisions within 45 CFR 164.524, that cover an individual’s access to protected health information. On January 23, 2020, a federal court vacated the “third-party directive” within the individual right of access “insofar as it expands the HITECH Act’s third-party directive beyond requests for a copy of an electronic

-9-

health record with respect to [protected health information] of an individual . . . in an electronic format.” Additionally, the fee limitation set forth at 45 CFR 164.524(c)(4) will apply only to an individual’s request for access to their own records, and does not apply to an individual’s request to transmit records to a third party.

The right of individuals to access their own records and the fee limitations that apply when exercising this right are undisturbed and remain in effect. OCR will continue to enforce the right of access provisions in 45 CFR 164.524 that are not restricted by the court order. [United States Department of Health and Human Services, Important Notice Regarding Individuals’ Right of Access to Health Records <https://www.hhs.gov/hipaa/court-order-right-of-access/index.html> (accessed April 7, 2023).]

IV. CONFLICT BETWEEN THE MRAA AND THE HITECH ACT

A. DEFENDANTS HAD 30 DAYS TO GRANT OR DENY WHITE’S RECORD REQUEST

Against this statutory and regulatory backdrop, White argues that defendants failed to comply with the 30-day requirement in the HITECH Act. We agree.

In arguing that defendants had to send his records within 30 days, White relies on 42 USC 17935(e)(1) and 45 CFR 164.524(b)(2). As stated, 42 USC 17935(e)(1) provides:

In applying [45 CFR 164.524], in the case that a covered entity uses or maintains an electronic health record with respect to protected health information of an individual—

(1) the individual shall have a right to obtain from such covered entity a copy of such information in an electronic format and, if the individual chooses, to direct the covered entity to transmit such copy directly to an entity or person designated by the individual, provided that any such choice is clear, conspicuous, and specific[.] [Footnote added.]

45 CFR 164.524(b)(2)(i) provides, in relevant part:

(b) Implementation specifications: requests for access and timely action. * * * (2) Timely action by the covered entity. (i) Except as provided in paragraph (b)(2)(ii) of this section, the covered entity must act on a request for access no later than 30 days after receipt of the request as follows. (A) If the covered entity grants the request, in whole or in part, it must inform the individual of the acceptance of the request and provide the access requested, in accordance with paragraph (c) of this section.

-10-

(B) If the covered entity denies the request, in whole or in part, it must provide the individual with a written denial, in accordance with paragraph (d) of this section.

See also 45 CFR 164.524(c)(3) (regarding time and manner of access and referencing 45 CFR 164.524(b)(2)). White asserts that the HITECH Act and the relevant regulations, therefore, control, and defendants had 30 days to act on his record request.

We agree with White. The Ciox court stated that “with respect to [protected health information] contained in an [electronic health record], the HITECH Act expressly entitles patients to obtain such information for themselves or to direct the information to a third party . . . .” Ciox Health, LLC, 435 F Supp 3d at 41. White, therefore, was entitled to obtain his protected health information that was contained in an electronic health record for himself, or to direct it to a third party (here, his attorney, Sitto).9 Based on 45 CFR 164.524(b)(2)(i), defendants had to act on White’s record request “no later than 30 days after receipt of the request . . . .” Defendants did not comply with this mandate. White signed his record request on February 1, 2021, and MRO indicated that it received the request on February 2, 2021. On February 3, 2021, MRO processed the request and generated the invoice for $54.56. The February 3, 2021 letter from MRO explained that the records would be sent to Sitto “upon receipt of your payment.” Although MRO essentially granted the request for access to White’s records, it conditioned transmission of the records on payment of the invoice, meaning defendants granted the request but potentially would never provide the access requested. Defendants, therefore, failed to comply with either prong of 45 CFR 164.524(b)(2)(i), which requires that a covered entity either grant the request and provide the access requested, see 45 CFR 164.524(b)(2)(i)(A), or deny the request and provide the individual with a written denial, see 45 CFR 164.524(b)(2)(i)(B).

B. THE HITECH ACT FEDERALLY PREEMPTS THE MRAA

Defendants did not comply with the 30-day requirement because they believed that MCL 333.26269(2) allowed them to withhold White’s records until he paid the applicable fee. White is correct in asserting that the HITECH Act does not contain any language allowing conditioning transmission of records on the prepayment of a fee. But, as defendants note, MCL 333.26269(2) allows health care providers and medical record companies to “refuse to retrieve or copy all or part of a medical record for a patient or his or her authorized representative until the applicable fee is paid.” White argues, however, that MCL 333.26269(2) conflicts with the HITECH Act and the relevant regulations such that federal law preempts the MRAA on this issue. Specifically, he argues that the requirement that a request for records be granted or denied within 30 days under federal law is inconsistent with the language in MCL 333.26269(2) allowing health care providers or medical record companies to condition transmission of records on prepayment of the applicable fee. We agree with White.

9 As discussed later in this opinion, however, this does not mean that the HITECH Act and related regulations control the fee that may be imposed.

-11-

In In re Schultz, 334 Mich App 730, 737-738; 965 NW2d 741 (2020), this Court explained the considerations for evaluating a claim of federal preemption:

Under the Supremacy Clause of the United States Constitution, US Const, art VI, cl 2, federal law preempts state law where Congress so intends. Federal law preempts state law in three circumstances: (1) where Congress has expressed an intent to preempt state law, (2) where state law regulates conduct in a field that Congress intended to occupy exclusively, and (3) where state law actually conflicts with federal law. In all pre-emption cases, and particularly in those in which Congress has legislated . . . in a field which the States have traditionally occupied, we start with the assumption that the historic police powers of the States were not to be superseded by the Federal Act unless that was the clear and manifest purpose of Congress. [Quotation marks, citations, and brackets omitted.]

As noted, under 45 CFR 164.524(b)(2)(i), a covered entity “must act on a request for access [to medical records] no later than 30 days after receipt of the records” in one of two ways. If the covered entity grants the record request, “in whole or in part, it must inform the individual of the acceptance of the request and provide the access requested, in accordance with paragraph (c) of this section.” 45 CFR 164.524(b)(2)(i)(A). But if the entity denies the request, “in whole or in part, it must provide the individual with a written denial, in accordance with paragraph (d) of this section.” 45 CFR 164.524(b)(2)(i)(B). See also 45 CFR 164.524(b)(2)(ii) (allowing covered entity to extend the time to act by no more than 30 days, provided two conditions are met). Accordingly, 45 CFR 164.524(b)(2)(i) requires a covered entity to either grant or deny a record request within 30 days of receiving it (unless it extends the time for doing so by no more than 30 days).

This plainly conflicts with MCL 333.26269(2). That provision allows a health care provider or medical record company (like Henry Ford and MRO) to condition release of records on prepayment of an applicable fee. Payment of that fee, however, might not occur until past the 30-day mark required under federal law. The MRAA, therefore, “actually conflicts” with the HITECH Act and its associated regulations that require a grant or denial within 30 days. In re Schultz, 334 Mich App at 737. Accordingly, the HITECH Act preempts the MRAA to the extent it circumvents the 30-day requirement.

In his brief on appeal, White references 45 CFR 160.203 as supporting his contention that federal law preempts state law here. That particular section of the Code of Federal Regulations relates to preemption of state law. Relevant here, it states:

A standard, requirement, or implementation specification adopted under this subchapter that is contrary to a provision of State law preempts the provision of State law. This general rule applies, except if one or more of the following conditions is met:

(a) A determination is made by the Secretary under § 160.204 that the provision of State law:

(1) Is necessary:

-12-

(i) To prevent fraud and abuse related to the provision of or payment for health care;

(ii) To ensure appropriate State regulation of insurance and health plans to the extent expressly authorized by statute or regulation;

(iii) For State reporting on health care delivery or costs; or

(iv) For purposes of serving a compelling need related to public health, safety, or welfare, and, if a standard, requirement, or implementation specification under part 164 of this subchapter is at issue, if the Secretary determines that the intrusion into privacy is warranted when balanced against the need to be served; or

(2) Has as its principal purpose the regulation of the manufacture, registration, distribution, dispensing, or other control of any controlled substances (as defined in 21 U.S.C. 802), or that is deemed a controlled substance by State law.

(b) The provision of State law relates to the privacy of individually identifiable health information and is more stringent than a standard, requirement, or implementation specification adopted under subpart E of part 164 of this subchapter. [45 CFR 160.203(a) and (b).]

This regulation supports the conclusion that the HITECH Act preempts state law to the extent it is inconsistent with the 30-day requirement. Under 45 CFR 160.203 generally, any standard, requirement, or implementation specification adopted that is contrary to state law preempts that provision of state law. But if the state law provision “relates to the privacy of individually identifiable health information and is more stringent than a standard, requirement, or implementation specification adopted under subpart E of part 164 of this subchapter,” then the state law provision is not preempted. 45 CFR 160.203(b). Subpart E of part 164 of this subchapter relates to “Privacy of Individually Identifiable Health Information” and includes 45 CFR 164.500 through 164.534. Notably, 45 CFR 164.524, discussed earlier, is included. Accordingly, if MCL 333.26269 were “relate[d] to the privacy of individually identifiable health information” and it were “more stringent than” a provision of 45 CFR 164.524, then MCL 333.26269 would not be preempted.

Under 45 CFR 160.202, “relates to the privacy of individually identifiable health information” means “with respect to a State law, that the State law has the specific purpose of protecting the privacy of health information or affects the privacy of health information in a direct, clear, and substantial way.” That subpart also defines “contrary” and “more stringent” as used in 45 CFR 160.203:

Contrary, when used to compare a provision of State law to a standard, requirement, or implementation specification adopted under this subchapter, means:

(1) A covered entity or business associate would find it impossible to comply with both the State and Federal requirements[.]

-13-

• • * *

More stringent means, in the context of a comparison of a provision of State law and a standard, requirement, or implementation specification adopted under subpart E of part 164 of this subchapter, a State law that meets one or more of the following criteria:

• • * *

(2) With respect to the rights of an individual, who is the subject of the individually identifiable health information, regarding access to or amendment of individually identifiable health information, permits greater rights of access or amendment, as applicable.

Based on these definitions and the language of 45 CFR 160.203, federal law preempts MCL 333.26269(2). The prepayment requirement in MCL 333.26269(2) is less stringent than federal law with respect to the degree of access it provides an individual with access to their individually identifiable health information. That is, MCL 333.26269(2) provides less access to the individually identifiable health information than 42 USC 17935(e)(1) and 45 CFR 160.524(b)(2)(i). Federal law requires that covered entities provide access to requested records within 30 days of the request (if granting the request). MCL 333.26269(2), on the other hand, has no time limitations and allows health care providers and medical record companies to withhold records until the requesting individual pays any applicable fees. This could extend well beyond the 30 days required by federal law (and beyond the additional 30 days allowed as an extension). Accordingly, 45 CFR 160.203 supports a finding of federal preemption.

V. STATE LAW APPLIES TO DETERMINING THE FEE DEFENDANTS COULD IMPOSE FOR PROVIDING COPIES OF MEDICAL RECORDS

White argues that the trial court erred when it found that state law, not federal law, applied for purposes of determining the fee defendants could impose for providing copies of his records. We disagree.

In Ciox, the federal district court vacated the 2013 Omnibus Rule “insofar as it expand[ed] the HITECH Act’s third-party directive beyond requests for a copy of ‘[electronic health records] with respect to [protected health information] of an individual . . . in an electronic format,” and the 2016 Guidance to the extent it “extend[ed] the Patient Rate to reach third-party directives.” Ciox Health, LLC, 435 F Supp 3d at 68-69. The Ciox court found that the plain language of the HITECH Act’s fee limitation related to providing protected health information in electronic form to a requesting individual, not a third party:

The HITECH Act does not speak to the allowable fees for [protected health information] that a person directs to a third party. Rather, the Act provides that, “[i]n applying [45 CFR 164.524],” “notwithstanding paragraph (c)(4) of such section, any fee that the covered entity may impose for providing such individual with a copy of such information . . . if such copy . . . is in an electronic form shall not be greater than the entity’s labor costs in responding to the request for the copy.” 42 U.S.C. § 17935(e)(3) (emphasis added). Thus, the plain text of the HITECH

-14-

Act’s fee limit concerns “providing” [protected health information] in electronic form to “such individual,” not to a third party. Id. This reading is buttressed by the neighboring statutory language used to create the third-party directive, which provides that individuals shall have the right . . . “to direct the covered entity to transmit such copy direct to an entity or person designated by the individual,” i.e., a third party. Id. § 17935(e)(1). Congress thus clearly understood how to reference third parties in the HITECH Act when it wanted to but elected not to do so when establishing the fee limitation. Also, it stands to reason that, by expressly referencing the existing Patient Rate regulation, Congress did not intend to modify the then-existing scope of the Patient Rate, which, since its inception in 2000, applied only to delivery of [protected health information] to the individual requester, and not to third parties. If Congress had intended to expand the Patient Rate beyond its original parameters, the court would have expected it to say so more clearly. [Ciox Health, LLC, 435 F Supp 3d at 58.]

The Patient Rate, therefore, applies only to requests for protected health information that are to be sent directly to the patient, not a third party. See Ciox Health, LLC, 435 F Supp 3d at 58, 66-69. See also United States Department of Health and Human Services, Important Notice Regarding Individuals’ Right of Access to Health Records <https://www.hhs.gov/hipaa/court- order-right-of-access/index.html> (accessed April 7, 2023) (“[T]he fee limitation set forth at 45 CFR 164.524(c)(4) will apply only to an individual’s request for access to their own records, and does not apply to an individual’s request to transmit records to a third party.”).

Here, White requested that his records be sent electronically to his attorney, Sitto. He had the right to do this. See Ciox Health, LLC, 435 F Supp 3d at 41 (“[T]he HITECH Act expressly entitles patients to obtain such information for themselves or to direct the information to a third party . . . .”). But because the fee limitation in the HITECH Act applies only to medical records directed to patients, not third parties, defendants10 were not limited to imposing a fee based on their labor costs for producing the records. See Ciox Health, LLC, 435 F Supp 3d at 58 (“[S]ince its inception in 2000, [the Patient Rate] applied only to delivery of [protected health information] to the individual requester, and not to third parties”). Instead, HHS’s “expectation [was] that other

10 Many of the regulations at issue, including 45 CFR 164.524(b) and (c), refer only to “covered entities,” not “business associates.” As noted earlier, MRO qualifies as a “business associate.” Cf Ciox Health, LLC, 435 F Supp 3d at 39 (finding that the plaintiff, Ciox Health, qualified as a “business associate.”). Even so, “HHS’s regulations all but ensure that business associates will limit the fees they charge in a manner consistent with HHS’s interpretation of the [restrictions imposed by the regulations]. The regulations make expressly covered entities liable for their business associates’ violations.” Id. at 49; see id. at 49-50 (noting that covered entities have “structured their contracts to require their business associates to follow the regulations” and indicating that Ciox Health’s contracts “include[d] provisions requiring Ciox to indemnify the covered entity for any violation . . . that is attributable to the covered entity for Ciox’s actions . . . .”) (citation omitted); see also Schutte v Ciox Health, LLC, 28 F4th 850, 857 n 2 (CA 7, 2022) (providing language from Ciox, 435 F Supp 3d at 30, referenced in this footnote). Further, White’s initial request was directed at Henry Ford, not MRO.

-15-

existing practices regarding fees, if any, for the exchange of records not requested by an individual will not be affected by this rule.” Id. at 40, quoting 65 Fed Reg at 82,754. Defendants, therefore, could charge White for his records based on existing state law related to such requests—MCL 333.26269(1).

MCL 333.26269(1) governs fees a health care provider or medical records company may charge for medical record requests. It provides:

(1) Except as otherwise provided in this section, if a patient or his or her authorized representative makes a request for a copy of all or part of his or her medical record under section 5, the health care provider, health facility, or medical records company to which the request is directed may charge the patient or his or her authorized representative a fee that is not more than the following amounts:

(a) An initial fee of $20.00 per request for a copy of the record.

(b) Paper copies as follows:

(i) One dollar per page for the first 20 pages.

(ii) Fifty cents per page for pages 21 through 50.

(iii) Twenty cents for pages 51 and over.

(c) If the medical record is in some form or medium other than paper, the actual cost of preparing a duplicate.

(d) Any postage or shipping costs incurred by the health care provider, health facility, or medical records company in providing the copies.

(e) Any actual costs incurred by the health care provider, health facility, or medical records company in retrieving medical records that are 7 years old or older and not maintained or accessible on-site. [MCL 333.26269(1).]

Two years after the effective date of the MRAA (April 1, 2004), “the department of community health shall adjust on an annual basis the fees prescribed by subsection (1) by an amount determined by the state treasurer to reflect the cumulative annual percentage change in the Detroit consumer price index.” MCL 333.26269(6).

Here, White requested his records be provided in electronic format only and sent directly to his attorney, Sitto. MRO responded to White’s request with an invoice charging him $54.56 for 26 pages of records. This total balance included a $25.38 search-and-retrieval fee, $25.40 for “Tier 1” pages printed and $3.78 for “Tier 2” pages printed. The adjusted numbers are based on the 2020 MRAA fee schedule for paper copies, produced pursuant to MCL 333.26269(6). MRO charged White based on the fee for paper copies. Given that White requested his records in electronic format, this was improper. Instead, MRO was limited to charging White the initial fee per request for a copy of the record, MCL 333.26269(1)(a), and the actual cost of preparing a duplicate, as the medical record was in a form or medium other than paper (electronic).

-16-

The $25.38 initial fee that MRO charged was, therefore, appropriate. The fees based on the number of pages printed, however, were not. The only additional fee that could be charged was the actual cost of preparing a duplicate. The trial court erred in finding the fee charged based on pages printed was appropriate. We, therefore, remand to the trial court for it to determine appropriate fee based on the actual cost of preparing a duplicate record.

VI. WHITE’S MCPA CLAIM IS BARRED BECAUSE HE REQUESTED HIS MEDICAL RECORDS FOR LITIGATION PURPOSES

White argues that the trial court erroneously dismissed his MCPA claim under the mistaken notion that Slobin, 469 Mich at 211, barred that claim. We disagree.

“The MCPA provides protection to Michigan’s consumers by prohibiting various methods, acts, and practices in trade or commerce.” Slobin v Henry Ford Health Care, 469 Mich 211, 215; 666 NW2d 632 (2003). White alleged that defendants’ withholding of his medical records violated MCL 445.903(1)(n), (q), and (z), which provide:

(1) Unfair, unconscionable, or deceptive methods, acts, or practices in the conduct of trade or commerce are unlawful and are defined as follows:

• • * *

(n) Causing a probability of confusion or of misunderstanding as to the legal rights, obligations, or remedies of a party to a transaction.

• • * *

(q) Representing or implying that the subject of a consumer transaction will be provided promptly, or at a specified time, or within a reasonable time, if the merchant knows or has reason to know it will not be so provided.

• • * *

(z) Charging the consumer a price that is grossly in excess of the price at which similar property or services are sold.

With respect to MCL 445.903(1)(z), the claim of improper charging, our Supreme Court has stated that “[s]uch improper charging is only unlawful under the act, however, ‘in the conduct of trade or commerce’ as defined in the act.” Slobin, 469 Mich at 216. The MCPA defines “trade or commerce” as the “conduct of a business providing goods, property, or service primarily for personal, family, or household purposes.” MCL 445.902(1)(g), as amended by 2006 PA 508. See also Slobin, 469 Mich at 216 (noting the definition of “trade or commerce” which was, at the time Slobin was decided, defined under MCL 445.902(1)(d)).11

11 For purposes of this case, the definition of “trade or commerce” remained essentially unchanged.

-17-

In Slobin, our Supreme Court confronted the question of whether a claim could be sustained under the MCPA based on a law firm’s request for its clients’ medical records. Slobin, 469 Mich at 212-213. The Court held that it could not:

[A] claim for damages based upon a law firm’s request for the medical records of a client it is representing in litigation cannot be sustained under the MCPA. Such a claim fails as a matter of law because obtaining medical records for the purpose of litigation is not ‘primarily for personal, family, or household use,’ as required by the act. [Id. at 218.]

The trial court did not err when it dismissed White’s MCPA claim. White argues that he did not seek the records for litigation purposes, but rather, “for personal purposes for his personal injury claim” and that he simply “sought to restore himself, personally, to his pre-accident status.” White attempts to distinguish his case from Slobin by arguing that Slobin involved a law firm requesting the medical records for “a business purpose,” but, here, “White requested his record be sent to his lawyer,” i.e., “[i]t was White’s request, not his lawyer’s request.” Regardless of how White characterizes the request, it was for the purpose of litigation. In fact, in his responses to the dispositive motions of both MRO and Henry Ford, White admitted that he sought his medical records for litigation purposes. Both responses contained the following language: “White sought to make a bodily injury claim against the at-fault driver and retained Auto Accident Attorneys, PLLC. In order to properly pursue his personal injury claim, White needed his medical record from Henry Ford.” The fact that White was pursuing a personal injury claim does not mean his record request was for personal purposes; to pursue that claim, he had to initiate litigation. Under Slobin, when an individual seeks records for litigation purposes, a claim under the MCPA cannot be sustained. Slobin, 469 Mich at 218. The trial court, therefore, did not err in dismissing White’s MCPA claim.

VII. CONCLUSION

Defendants failed to act on White’s request for his medical records within 30 days, as they were required to under the HITECH Act and related regulations, because they believed that MCL 333.26269(2) allowed them to withhold White’s records until he paid the applicable fee. That prepayment provision conflicts with the 30-day requirement under the HITECH Act, so the HITECH Act’s 30-day requirement preempts the MRAA’s prepayment provision. Still, state law applies for purposes of determining the fee defendants could impose for providing White’s records. The trial court correctly applied state law when determining the proper fee, but erred when it found that MRO charged White an appropriate fee: because White requested his records in electronic format, defendants improperly charged him for paper copies. And when medical records are obtained for litigation purposes, as White essentially admits they were here, the MCPA does not apply. The trial court, therefore, properly dismissed White’s MCPA claim.

Accordingly, for the reasons stated in this opinion, we affirm in part, reverse in part, and remand for further proceedings. We do not retain jurisdiction.

/s/ Noah P. Hood /s/ Kristina Robinson Garrett /s/ Kirsten Frank Kelly

-18-