Ciox Health, LLC v. Hargan, 435 F.Supp.3d 30

Background

Ciox Health is a business-associate medical-records vendor that fulfills millions of PHI requests and contracts with covered entities; its contracts tie fees and liability to HIPAA/HITECH requirements.
The HIPAA Privacy Rule (2000) created a patient-access fee limit (the “Patient Rate”) intended to limit fees for individuals requesting their own PHI; historically HHS said that limit did not apply to requests made for or by third parties.
The HITECH Act (2009) added a third‑party directive allowing patients to direct EHRs to be sent to designees, and capped fees for electronic copies to a covered entity’s labor costs for responding to the request.
The 2013 Omnibus Rule broadened the HITECH third‑party directive to PHI in any format and addressed what component labor costs were recoverable under the Patient Rate.
A 2016 HHS Guidance declared the Patient Rate applies when an individual directs PHI to a third party, excluded search/retrieval labor from recoverable costs, and listed three methods to calculate the Patient Rate (actual, average, or $6.50 flat fee).
Ciox sued under the APA challenging (i) the 2013 rule’s format expansion and format/format‑of‑delivery mandate and (ii) the 2016 Guidance’s Patient Rate expansion, labor‑cost exclusions, and tripartite calculation methods; court vacated the 2013 expansion and the 2016 Patient Rate expansion, upheld the labor‑cost exclusion as interpretive, and held the three calculation methods non‑final.

Issues

Issue	Plaintiff's Argument	Defendant's Argument	Held
Whether the Patient Rate applies when an individual directs PHI to a third party	Ciox: 2016 Guidance unlawfully extends the Patient Rate to third‑party directives and is a legislative rule that required notice‑and‑comment	HHS: Guidance merely interprets existing regulations; Patient Rate already governs such requests	Court: 2016 Guidance’s extension is a legislative change adopted without notice‑and‑comment and is vacated (not final rulemaking)
Whether HHS could expand the HITECH third‑party directive (EHR only) to PHI in any format (2013 Omnibus Rule)	Ciox: 2013 Rule exceeds statutory authority and conflicts with HITECH’s plain text limiting the third‑party directive to EHRs	HHS: Section 264(c) and rulemaking authority permit harmonizing access across formats to avoid disparate regimes	Court: 2013 expansion beyond EHRs is arbitrary/ultra vires and vacated insofar as it goes beyond HITECH’s text
Whether HHS’s exclusion of search/retrieval labor from recoverable Patient Rate costs required notice‑and‑comment	Ciox: exclusion is a substantive change and should have been promulgated as a legislative rule	HHS: the exclusion is an interpretive clarification of §164.524 and need not undergo notice‑and‑comment	Court: exclusion is interpretive (final for review) and lawful; notice‑and‑comment not required
Whether the 2016 Guidance’s three calculation methods for the Patient Rate are final, reviewable agency action	Ciox: methods constrain industry and are a substantive rule requiring notice‑and‑comment	HHS: methods are guidance/options that clarify compliance	Court: listing three permissive options is non‑final/non‑reviewable (not binding), claim dismissed

Key Cases Cited

Lujan v. Defenders of Wildlife, 504 U.S. 555 (standing and causation requirements)
Bennett v. Spear, 520 U.S. 154 (final agency action—two‑prong test)
Chevron U.S.A. Inc. v. Nat. Res. Def. Council, Inc., 467 U.S. 837 (agency statutory interpretation framework)
Hawkes Co. v. U.S. Army Corps of Engineers, 136 S. Ct. 1807 (pragmatic approach to finality; practical consequences can make guidance reviewable)
Lexmark Int’l, Inc. v. Static Control Components, Inc., 572 U.S. 118 (lenient APA zone‑of‑interests test)
General Elec. Co. v. EPA, 290 F.3d 377 (D.C. Cir.) (when guidance prescribes binding options, may be treated as legislative)
Tozzi v. HHS, 271 F.3d 301 (D.C. Cir.) (third‑party causation/substantial factor test for standing)
Abbott Labs. v. Gardner, 387 U.S. 136 (ripeness for judicial review)