Lead Opinion
Opinion by
In this declaratory judgment action challenging the Colorado Board of Health's "patient copy" rule, plaintiff, the Colorado Consumer Health Initiative (CCHIT), appeals the summary judgment entered for defendant, the Colorado Board of Health, as well as the denial of its cross-motion for summary judgment. We affirm the trial court's order denying CCHI's summary judgment motion, reverse its order entering summary judgment for the Board, and remand for further proceedings.
I. Facts
The Colorado Board of Health (the Board) is a state regulatory board that has the authority to adopt and amend rules regarding publiс health. § 25-1-108(1)(c)(T), CRS. 2009. The Board's rule generally known as the "patient copy rule" establishes the fees that health care facilities can charge for providing copies of a patient's medical records. Standards for Hospitals & Health Facilities Rule 1I-5.2.38.4, 6 Code Colo. Regs. 1011-1.
In 2001, the Association of Health Information Outsourcing Services (AHIOS), a national lobby group for the health information management outsourcing industry, petitioned the Board to increase the copying fees charged to patients and third parties. The Board adopted AHIOS's proposed аmendment.
In 2007, AHIOS again petitioned the Board to increase copying fees. However, the 2007 proposed amendment excluded from the fee increase individuals covered by the federal Health Insurance Portability and Accountability Act (HIPAA). To support the proposed fee increases, AHIOS included a self-compiled survey of the copying fees charged to certain third parties (attorneys and insurers) by forty-two other states. CCHI opposed the amendment.
In 2008, the Board adopted AHIOS's 2007 proposed amendment. CCHI subsequently filed a complaint for deсlaratory relief challenging the Board's rules amending the patient copy rule in 2001 and 2008. On cross-motions for summary judgment, the court granted the Board's motion and denied CCHI's.
CCHI appeals.
IL Standard of Review
We review a summary judgment de novo. Brodeur v. Am. Home Assurance Co.,
When reviewing a challenge to board or agency rules, we presume a rule is valid if it was adopted pursuant to a statutory rule-making proceeding, and the challenging party has the burden to establish the rule's invalidity by demonstrating that it is
arbitrary or capricious, a denial of statutory right, contrary to constitutional right, power, privilege, or immunity, in exсess of statutory jurisdiction, authority, purposes, or limitations, not in accord with the procedures or procedural limitations of [the Colorado Administrative Procedure Act (APA)] or as otherwise required by law, an abuse or clearly unwarranted exercise of discretion, based upon findings of fact that are clearly erroneous on the whole record, unsupported by substantial evidence when the record is considered as a whole, or otherwise contrary to law.
§ 24-4-106(7), C.R.S.2009; accord Augustin v. Barnes,
"Whenever the scope of review is somewhere between the two extremes of de novo review and complete unreviewability, as it usually is, the key to scope of review is not the choice of formulas or standards, such as 'substantial evidence' or 'arbitrary and capri-clous."" Citizens for Free Enterprise v. Dep't of Revenue,
Moreover, in reviewing an agency action, courts shall determine "all questions of law and interpret the statutory provisions involved and shall apply such interpretation to the facts duly found or еstablished." Transponder Corp. v. Property Tax Administrator,
A rule may not modify or contravene an existing statute, and any rule that is inconsistent with or contrary to a statute is void. Ettelman v. Colorado State Bd. of Accountancy,
Nevertheless, courts should give deference tо an agency's construction of the rules it promulgates, as well as the agency's construction of its enabling legislation, "unless the agency's interpretation is not in accordance with law." Esser,
Courts, however, have a duty to invalidate administrative rules that conflict with the statute's design. Cartwright,
III Analysis
A. Compliance with HIPAA
CCHI contends that, because the patient copy rule does not comply with HIPAA, the trial court erred in entering summary judgment for the Board and against CCHI. We
We review de novo the legal question of whether the 2001 and 2008 rules amending the Board's patient copy rule violate HIPAA and its related regulations. See Transponder Corp.,
1. Legal Principles
HIPAA is federal legislation that mandated reforms regarding heаlth insurance access, portability, renewability, mandatory coverage, and preexisting condition exclusions. Pub.L. No. 104-191, 110 Stat. 1986 (Aug. 21, 1996) (codified primarily in titles 18, 26, and 42 of the United States Code); Usick v. American Family Mut. Ins. Co.,
HIPAA regulations mandate that covered health care entities may only charge a "reasonable, cost-based fee" for providing copies of patient health records, and the fee may only include the cost of "[clopying, including the cost of supplies for and labor of copying ...; [plostage [where applicable}; and [plre-paring an еxplanation or summary of the protected health information [where applicable]." 45 CFR. § 164.524(c0)(d)0)-0H). However, HIPAA regulations apply only to the "person who is the subject of protected health information" (the patient) or the "person [who] has authority to act on behalf of [a patient] ... in making decisions related to health care" (the patient's "personal representative"). 45 C.FE.R. §§ 160.103, 164.502(g).
HIPAA and its related regulations preempt state laws that are less stringent than HIPAA regulations See HIPAA, Pub.L. 104-191, see. 264(c)(@); South Carolina Med. Ass'n v. Thompson,
Here, the Board's 2001 rule amending the patient copy rule provided that patients or their personal representatives "shall pay for the reasonable cost of obtaining a copy of [the patient's] records, not to exeeed $14.00 for the first ten or fewer pages, $.50 per page for pages 11-40, and $.33 per page for every additional page," plus postage, shipping, and sales tax. The pаtient copy rule remained unchanged until the Board's 2008 amendment. The 2008 rule provided that individuals to whom HIPAA does not apply "shall pay for the reasonable cost of obtaining a copy of [the patient's] record, which shall be $16.50 for the first ten or fewer pages, $.75 for pages 11-40, and $.50 per page for every additional page," plus postage, shipping, and sales tax. The 2008 amendment also continued the 2001 fees for HIPAA-covered individuals (Le., patients and patients' personal representatives).
Because HIPAA was not in effect until 2003, the Board's 2001 rule amending the рatient copy rule was not subject to HIPAA's rules regarding copying patient records. However, when HIPAA took effect in 2008, the portion of the 2001 rule that applies to HIPAA covered individuals-which the Board readopted in the 2008 rulemaking-was required to come into compliance with hHIPAA.
As stated, HIPAA regulations mandate that covered health care entities may only charge a "reasonable, cost-based fee" for providing copies of patient health records, and the fee may only include the cost of "copying, including the cost of supplies for and labor of copying." 45 CER. § 164.524(c)(4). Thus, to comply with HI-PAA, the portion of the patient copy rule that applies to HIPAA-covered individuals must be cost-based and must not include
2. Application
Here, neither CCHI nor the Board provided the trial court with undisputed facts demonstrating that it was legally entitled to summary judgment regarding the patient copy rulе's compliance with HIPAA.
CCHI's summary judgment motion simply recited, without supporting documents, a list of "undisputed facts." Although CCHI asserted that the administrative records would be provided to support its motion, they never were. Thus, CCHI did not present undisputed facts showing the patient copy rule fees for HIPAA-covered individuals were not cost-based or included ancillary costs. Accordingly, CCHI did not demonstrate it was legally entitled to judgment on this issue. See Johnson v. Colorado State Bd. of Agriculture,
To supрort its summary judgment motion, the Board provided the trial court copies of the 2001 patient copy rule, the 2008 patient copy rule, AHIOS's 2007 proposed amendment to the patient copy rule (which the Board adopted in 2008), and an affidavit. However, because the affidavit was taken after the Board adopted the 2001 and 2008 rules, it could not have been a basis for the rule. See § 24-4-108(4)(a) ("rules promulgated by the agency shall be based on the record"). The 2001 and 2008 patient copy rules also did not support the Board's motion because they do not indicate thаt the copy fees for HIPAA-covered individuals were cost-based and excluded ancillary costs.
Thus, the Board's entitlement to summary judgment turned on whether AHIOS's 2007 proposed amendment demonstrated that the portion of the rules that apply to HIPAA-covered individuals was cost-based and excluded ancillary costs. However, the proposed amendment only included a single reference to HIPAA-covered individuals: "The current rate shall not change for the purpose of the patient and or the patient's personal representative as defined by HIPAA." Thus, the proposed amendment did not show that the copy fees charged to HIPAA-covered persons were cost-based and excluded ancillary costs. Therefore, the Board did not demonstrate that it was legally entitled to judgment on the issue of HIPAA compliance. See Johnson,
Accordingly, the trial court did not err in denying CCHI's summary judgment motion regarding the patient copy rule's compliance with HIPAA, but erred in granting the Board's motion on this issue.
B. Compliance with Colorado Law
CCHI also contends that the trial court erred in entering summary judgment for the Board and against CCHI on the issue of the patient copy rule's compliance with Colorado law. We conclude that neither party was entitled to summary judgment on this issue.
As noted, we review de novo the trial court's legal conclusions, including statutory interpretation, and we give appropriate deference to the Board's interpretation of a statute it is charged with administering unless the interpretations are inconsistent with the statute's clear language or legislative intent. See Esser,
Colorado law provides that health care facilities must furnish copies of medical records to the patient "upon the payment of the reasonable costs." § 25-1-801(1)(b)(I), C.R.S. 2009. Similarly, individual health care providers must make copies available to patients and their designated representatives "upon reasonable notice and payment of the reasonable costs." § 25-1-802(1)(b)(I), C.R.8.2009. Because the General Assembly used the phrase "payment of the reasonable costs," the statutes' plain language only authorizes health care facilities and individual providers to charge patients (and their designated representatives, in the case of individual health care providers) for the reasonable costs of providing the copies. See Denver Post Corp. v. Ritter,
CCHI, however, contends that "the reasonable costs" may not include the costs of ancillary services involved in providing the copies, such аs record retrieval, processing, record reassembling, and invoicing. Specifically, CCHI argues: (1) because the statutes provide that patients or their representatives may obtain copies upon payment of "the reasonable costs" and not upon "multiple reasonable costs," the amount charged may not include costs beyond the supplies and labor of copying; (2) the statutes' free-inspection provisions bar health care facilities and providers from charging for costs inherent in inspection; and (8) Colorado law mandates thаt patients and their designated representatives be subject to the same charges. We reject each argument in turn.
First, although the statutes authorize health care facilities and providers to charge for "the reasonable costs" of providing copies, we reject CCHI's argument that "the" indicates that health care facilities and providers may only charge for the singular costs directly incurred in the physical act of copying. The terms "costs" is not singular, and the statutes do not limit the "costs" to the costs of supplies and the labor of copying. See Dubois v. Abrahamson,
Second, we reject CCHI's argument that, because sections 25-1-801(1)(a) and 25-1-802(1)(a), C.R.S.2009, entitle patients and their representatives to inspect their medical records without charge, charging for the costs inherent in such inspection is necessarily not a "reasonable cost." Neither the inspection provisions nor the copying provisions state that the costs inherent in record inspection cannot be charged as part of the "reasonable сosts" charged for providing copies. See Mason v. People,
Third, we reject CCHI's argument that Colorado law mandates that patients and their designated representatives be subject to the same charges. Section 25-1-802(1)(b)(I) simply states that a "copy of such [medical] records ... shall be made available to the patient or the patient's designated representative, upon ... рayment of the reasonable costs." As discussed, health care facilities and providers may only charge patients for the reasonable costs of providing the copies. See Davison,
2. Application
Here, neither CCHI nor the Board provided the trial court with undisputed facts
As discussed, the administrative records for the 2001 and 2008 rulemakings were never provided to the trial court. Thus, CCHI failed to present undisputed facts showing that the fees set forth in the 2001 and 2008 patient copy rules did not reflect the reasonable costs of providing cоpies. Accordingly, CCHI did not demonstrate it was legally entitled to judgment on this issue. See Johnson,
Also, as discussed, to support its summary judgment motion, the Board provided the trial court with the 2001 and 2008 patient copy rules, AHIOS's 2007 proposed amendment, and an affidavit Again, because the affidavit was not part of the administrative record, it could not have been the basis of the rules. See § 24-4-108(d4)(a) ("rules promulgated by the agency shall be based on the record"). The 2001 and 2008 patient copy rules also did not support the Board's summary judgment motion because they do not indicate that the copy fees reflect costs.
Thus, as discussed in part IILB.1, the Board's entitlement to summary judgment on the issue of compliance with Colorado law turned on whether AHIOS's 2007 proposed amendment demonstrates that the copy fees in the rules reflect the costs of providing copies. Sections 25-1-801(1)(b)(I's and 25-1-802(1)(b)(I)'s plain language only authorizes charging patients, and in the case of section 25-1-802(1)(b)(I) their designated representatives, for the reasonable costs of providing copies.
The 2007 proposed amendment stated that the copy fees charged to those not covered by HIPAA were selected simply by averaging the fees charged to attorneys and insurers in forty-two other states. The proposed amendment did not include data regarding the actual costs of providing copies in Colorado, nor did it indicate whether the other states' fees were based on the actual costs of providing copies in those states. It did not indicate whether the costs of providing copies in Colorado mirror the costs of providing copies in the other states, nor whether the other states' laws require the fees to reflect the costs of providing copies. It also did not include data on what fees other states charge to personal representatives who are not attorneys or insurers.
Thus, AHIOS's 2007 proposed amendment did not show that the patient copy rule's copy fees reflected the reasonable costs of providing copies. Therefore, the Board did not demonstrate that it was legally entitled to judgment on the issue of compliance with Colorado law. See Johnson,
Accordingly, the trial court did not err in denying CCHI's summary judgment motion on this issue, but erred in granting the Board's motion on this issue.
The court's order denying CCHI's summary judgment motion is affirmed, and its order granting the Board's summary judgment motion is reversed. The case is remanded for further proceedings as directed.
Concurrence Opinion
concurring in part and dissenting in part.
I respectfully dissent from the portion of the majority's opinion that concludes the trial court erred in granting summary judgment in favor of the Board.
CCHI did not provide any facts to indicate the 2001 and 2008 rules adopted by the Board violаted the "reasonable cost-based fee" requirements under HIPAA and Colorado's Patient Records Act (CPRA). CCHI relies instead on the implication that the 2001 and 2008 rules are ipso facto a violation of such "reasonable, cost-based fee" requirements because the Board did not conduct a cost study. Such reasoning is not logically valid.
The syllogism stating CCHI's position is as follows: If the Board bases the rule on a cost study, the rule satisfies the "reasonable, cost-
This case requires us to decipher the interplay of our review of an order granting summary judgment and our review of a challenge to an agency rule. I begin by doing so.
We review de novo the district court's grant of summary judgment. A.C. Excavating v. Yacht Club II Homeowners Ass'n,
The parties agree, as they did before the district court, that no issues of material fact exist. Accordingly, we may resolve the case based on the law which governs judicial review of agency rules. Section 24-4-106(11)(e), C.R.S.2009, provides that "[the standard for review as set forth in subsection (7) of this section shall apply to appeals brought under this subsection (11)."
Section 24-4-106(7), C.R.S8.2009, in turn, requires the reviewing court to hold an agency rule unlawful
[)f it finds that the ageney action is arbitrary or capricious, a denial of statutory right, contrary to constitutional right, power, privilege, or immunity, in excess of statutory jurisdiction, authority, purposes, or limitations, not in accord with the procedures or procedural limitations of this article or as otherwise required by law, an abuse or clearly unwarranted exercise of discretion, based upon findings of fact that are clearly erroneous on the whole record, unsupported by substantial evidencе when the record is considered as a whole, or otherwise contrary to law.
However, "[rlules adopted by an agency are presumed to be valid. Any challenging party has a heavy burden to establish invalidity of the rule by demonstrating that the agency violated constitutional or statutory law, exceeded its authority, or lacked a basis in the record for the rule." Colo. Ground Water Comm'n v. Eagle Peak Farms, Ltd.,
The district court granted the Board's motion for summary judgment because CCHI did not carry its burden of proving the rules' invalidity. The district court found:
[CCHI] asserts that the Board's adoption of thе Amendments was contrary to State and Federal Law and should be declared void. Specifically, [CCHI] argues that in establishing the fees medical providers may charge individuals and their personal representative for copying medical records, the Board violated HIPAA's "cost-based" requirement by failing to utilize a cost study, and also that the Board wrongly permitted the ... recovery of costs for ancillary services for those making those photocopies. [The Board] responds that the Amendments were reasonable and lawful, therefore valid.
With respeсt to the adoption of the 2001 Amendment, the Board states that [HI-PAA] regulations concerning copy costs had been suspended by Executive Order and were not effective until April 2008.*534 Moreover, [CCHI] has offered no substantial evidence of Board violation in the establishment of the 2001 copy costs. The Court agrees and finds that [CCHI] has not established that the Board acted in an unconstitutional manner, exceeded its authority or acted in a manner contrary to the statutory requirements.
As for the 2008 Amendment, the Board increased the cost of copying medical records сharged to the representative of an individual, "other than a personal representative as defined in [HIPAA]." The Board contends that no changes were made to the cost of copying medical records for individuals or their personal representatives and therefore, the amended copy costs do not violate HIPAA. Moreover, even if HIPAA was implicated, the Board argues that it complied with its responsibility to promulgate rules interpreting the "reasonable-cost-based" requirement, by basing copy fees on a nation[al] average of states that also comply with [HIPAA]. Finally, the Board contends that State law only mandates that healthcare facilities provide a copy of ree-ords upon payment at a reasonable cost. C.R.S. § 25-1-801(1)(b)(I). The amended fee only applies to persons other than HI-PAA protected individuals and their personal representatives. The fact that the increased fees take into account ancillary costs do not make the charges unreasonable. The Court agrees and finds that [CCHI] has failed to demonstrate that HI-PAA applies to the 2008 Amendment, thаt the Board's fee-setting methodology is unreasonable, or that the Board acted outside its established authority.
[[Image here]]
Based on the above, the Court hereby DENIES [CCHI's] Motion for Summary Judgment and GRANTS [the Board's] Cross-Motion for Summary Judgment.
Because the Board has no burden to prove the 2001 rules and the 2008 amendments valid, and CCHI did not provide any facts to indicate the result reached by the Board in adopting those rules violated HIPAA's or CPRA's "reasonable, cost-based fee" requirements, I would affirm the district court's granting of summary judgment in favor of the Board. See Colo. Ground Water,
Moreover, the parties agree that CCHI's cost study was one option the Board could have used in promulgating its rules, but the Board did not consider this option because CCHI's proposal to the Board was untimely. However, the Board permitted CCHI to submit a timely proposal in the future. I conclude that is the better approach.