Privacy Officer's Roundtable

HHS website update in response to Ciox directive

  • 1.  HHS website update in response to Ciox directive

    Posted 02-11-2020 10:35 AM
    In light of the Ciox directive, HHS has partially updated their website. Go to this page:

    They have a header on the page that talks about the Ciox directive. It says everything below (the header) remains in effect except those parts rescinded by the Ciox decision. Then it leaves all of the text untouched. So if you just read through the text, it still says you have to send all PHI to whomever the patient directs you to and that the fee is restricted just like it is with a right of access request directly by the patient. This is a poor way to go for HHS, as far as being helpful to the public. They should simply fix the body text, not just have a disclaimer at the top. That's like saying some of what I'm about to tell you is not true. Good luck.

    They do have a link in the header that takes you to a new webpage that explains what got rescinded.

    Important Notice Regarding Individuals' Right of Access to Health Records

    On January 25, 2013, HHS published a final rule entitled "Modifications to the HIPAA Privacy, Security, and Enforcement Rules Under the Health Information Technology for Economic and Clinical Health Act, and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules." (2013 Omnibus Rule). A portion of that rule was challenged in federal court, specifically provisions within 45 C.F.R. §164.524, that cover an individual's access to protected health information. On January 23, 2020, a federal court vacated the "third-party directive" within the individual right of access "insofar as it expands the HITECH Act's third-party directive beyond requests for a copy of an electronic health record with respect to [protected health information] of an individual . . . in an electronic format." Additionally, the fee limitation set forth at 45 C.F.R. § 164.524(c)(4) will apply only to an individual's request for access to their own records, and does not apply to an individual's request to transmit records to a third party.

    The right of individuals to access their own records and the fee limitations that apply when exercising this right are undisturbed and remain in effect. OCR will continue to enforce the right of access provisions in 45 C.F.R. § 164.524 that are not restricted by the court order. A copy of the court order in Ciox Health, LLC v. Azar, et al., No. 18-cv-0040 (D.D.C. January 23, 2020), may be found at

    If you download the file it comes without an extension. Know that it is a pdf and you may have to add ".pdf" as the extension to be able to open it. Of course there are other ways but this is for simplicity sake.

    Carl Russell
    Compliance Analyst, CHPC
    Delta Dental of Idaho

    Anything I say is my sole opinion and not of my company.
    2020 SCCE Membership