Quentin White v. Henry Ford MacOmb Hospital Corporation ( 2023 )

If this opinion indicates that it is “FOR PUBLICATION,” it is subject to
revision until final publication in the Michigan Appeals Reports.
STATE OF MICHIGAN
COURT OF APPEALS
QUENTIN WHITE, FOR PUBLICATION
April 20, 2023
Plaintiff-Appellant, 9:05 a.m.
v No. 360302
Macomb Circuit Court
HENRY FORD MACOMB HOSPITAL LC No. 2021-001284-PD
CORPORATION and MRO CORPORATION,
Defendants-Appellees.
Before: GARRETT, P.J., and K. F. KELLY, and HOOD, JJ.
HOOD, J.
Plaintiff, Quentin White (White), appeals as of right the order of the trial court granting
summary disposition in favor of defendant Henry Ford Macomb Hospital Corporation (Henry
Ford). We affirm in part, reverse in part, and remand for further proceedings.
I. BACKGROUND
This case started with a medical-record request that White sent to Henry Ford, asking
Henry Ford to send medical records to his attorneys. This case is about the proper fees and timing
associated with Henry Ford’s and defendant MRO Corporation’s (MRO)1 response to that request.
This case involves several provisions under the Michigan Medical Records Access Act (the
MRAA), MCL 333.26261 et seq., the Health Insurance Portability and Accountability Act
(HIPAA), 42 USC 1320d et seq., and the Health Information Technology for Economic and
Clinical Health Act (the HITECH Act), 42 USC 17901 et seq. It also involves regulations and
guidance related to HIPAA and the HITECH Act. Most notably, the 2013 regulations from the
United States Department of Health and Human Services (HHS), referred to as the 2013 Omnibus
Rule, as well as a document entitled, “Individuals’ Right under HIPAA to Access to Health
1
We refer to Henry Ford and MRO collectively as “defendants.”
-1-
Information 45 CFR 164.524,” also referred to as the 2016 Guidance. We provide an overview of
the statutory and regulatory framework in Section III below.
In late December 2020, White was injured in a motor vehicle accident. After the accident,
he received medical treatment at Henry Ford. White wanted to file a claim against the at-fault
driver, so he retained an attorney. And, as he indicated in his records request, to “properly pursue
his personal injury claim, [he] needed his medical record from Henry Ford.” So, on February 1,
2021, White signed a record request, labeled “HITECH RECORD REQUEST,” asking Henry Ford
to send his medical record to his attorney, Brent Sitto. The request explicitly asked that Henry
Ford provide the records “in electronic format only using Adobe Acrobat pdf format.”
MRO is a medical records provider that contracts with healthcare suppliers, like Henry
Ford, to maintain, retrieve, and produce individuals’ protected health information. White sent his
record request to Henry Ford on February 2, 2021. Some time between February 2, 2021, and
February 3, 2021, Henry Ford forwarded the request to MRO. On February 3, 2021, MRO
generated two letters related to White’s record request. The first letter, to Sitto, indicated that
MRO was processing the request on Henry Ford’s behalf. At the bottom of the letter, MRO, under
a heading entitled, “HITECH Rate Dispute,” referenced the January 2020 decision of the United
States District Court for the District of Columbia in Ciox Health, LLC v Azar, 435 F Supp 3d 30
(DDC, 2020). According to MRO’s summary, the Ciox decision vacated the portion of HHS’s
2016 Guidance that “allow[ed] patients to direct medical records to 3rd parties such as your
organization, for the same discounted rate allowed to [the] patient . . . .”
MRO addressed the second letter, which confirmed receipt of the record request, to Sitto.
It indicated that Henry Ford was “in the process of searching for and retrieving a copy of the
requested records” and that, if there were no issues with the request, MRO would send Sitto a “pre-
payment invoice.” The letter also explained that MRO would send the records to Sitto “upon
receipt of your payment.” The invoice, however, was also generated on February 3, 2021, the
same day as MRO’s two letters to Sitto. At the top of the invoice it states: “PREPAYMENT
REQUIRED[.]” The invoice indicated that there were 26 pages of records. The balance due under
the invoice was $54.56, which included a $25.38 search-and-retrieval fee, $25.40 for “Tier 1”
pages printed and $3.78 for “Tier 2” pages printed.
From February 2, 2021 until March 10 2021, neither White nor his attorneys responded to
the letters. On March 10, 2021, Sitto sent a letter to MRO addressing its letters regarding White’s
record request. Sitto’s letter noted that White’s HITECH record request “was received by your
office on 2-2-2021.” Sitto indicated that, on March 2, 2021, he or his law firm received MRO’s
notice about the record request. Sitto quoted language from federal regulations he claimed were
applicable, including 45 CFR 164.524(b) and (c)(3)(i). Sitto asserted that MRO had to provide the
records within 30 days of February 2, 2021, i.e., by March 4, 2021. Sitto indicated it had been
over 30 days and, as a result, MRO was “now subject to penalties for violation of federal law.” In
the same letter, Sitto rejected MRO’s reliance on Ciox and asserted that MRO could only charge
$6.50 under the HITECH Act. He asked MRO to forward the records and “an invoice for $6.50
maximum.”
In mid-March 2021, MRO faxed a letter regarding White’s record request to Sitto. MRO
reiterated that the provisions Sitto relied on to argue for the $6.50 fee no longer applied. MRO
-2-
indicated that White and Sitto were “invoiced correctly under HIPAA, HITECH and applicable
state law” and that the fee limitations from the HITECH Act only applied to requests from
individuals, not third parties, including law firms or situations where “the patient’s medical records
are being requested to be sent to a third party.” The letter also reiterated that MRO would provide
the requested copies of records “[u]pon payment of the balance due on the invoice.”
Less than a month later, White sued defendants, raising four claims: (1) unlawful detention,
and recover possession, of medical records under MCL 600.2920; (2) claim and delivery (replevin)
under MCR 3.105; (3) common-law conversion; and (4) declaratory relief, asking the court to
determine (a) the applicability of the HITECH Act, (b) the amount defendants could properly
charge White, and (c) any other determination necessary to adjudicate the case. The essence of
White’s claims was that defendants improperly withheld his medical records and he sought to
“recover possession” of those records. He alleged that defendants’ failure to provide his records
impeded his “ability to expeditiously prosecute his injury claims . . . .” White amended his
complaint in late May 2021, adding a fifth claim: violation of the Michigan Consumer Protection
Act (MCPA), MCL 445.901 et seq. Under this new claim, White alleged that defendants charged
him a fee “grossly in excess of the price at which similar property or services are sold.”
In mid-June 2021, Henry Ford’s attorney e-mailed White’s records to Sitto in PDF format.
According to MRO on appeal, this was done “at no-charge” and “to resolve the issue and avoid”
litigation costs.
In mid-August 2021, MRO moved for summary disposition of White’s claims under MCR
2.116(C)(8) and (10). MRO argued that it was not limited to charging a maximum of $6.50 for
the requested records, because, after Ciox, that fee limitation did not apply. It also argued that its
invoice was proper under the MRAA, which also allowed it to withhold White’s records pending
payment. MRO further argued that because White requested his records for litigation purposes,
his MCPA claim failed as a matter of law under Slobin v Henry Ford Health Care, 469 Mich 211;
666 NW2d 632 (2003). Henry Ford concurred in MRO’s motion.
White responded, arguing that MRO failed to comply with federal law when it did not act
on his record request within 30 days. He also argued that MRO ignored his request for electronic
records and improperly charged the state law rate for paper copies. White further argued that
MRO’s reliance on Ciox was misplaced, and that the prepayment requirement under MCL
333.26269(2) conflicted with the HITECH Act and was, therefore, federally preempted. And
White asserted that because he requested his record “for personal purposes for his personal injury
claim,” this case was distinguishable from Slobin and, thus, he had a valid MCPA claim.
After a hearing, the trial court issued an opinion and entered an order granting summary
disposition to defendants. The court first found that because an attorney is a third party under the
applicable statutory scheme, MRO could properly charge them above the Patient Rate. It also
noted that the Ciox court vacated the 2013 Omnibus Rule and 2016 Guidance. It also found that
White had failed to establish that Henry Ford kept its records in a form other than paper, as required
for MCL 333.26269(1)(c) to apply, despite his argument that MRO’s invoice was improper
because he asked for electronic records. The trial court further found that MRO’s fees were
reasonable, and that the HITECH Act and related regulations did not prohibit withholding records
-3-
until prepayment of a fee, as allowed under the MRAA. And the court found that Slobin precluded
White’s MCPA claim because he had requested the records for litigation purposes.
White moved for reconsideration. He argued that the trial court prematurely granted
summary disposition before the parties completed discovery. His overarching argument was that,
as it related to Henry Ford, there was a factual dispute regarding whether its medical records were
kept in a form other than paper, such that MCL 333.26269(1)(c) applied. He asserted that
discovery on that issue likely would resolve the dispute, noting that had the trial court not granted
MRO’s dispositive motions, Henry Ford or MRO could comply with discovery orders related to
producing various documents and representatives. At the hearing on the motion, the trial court
acknowledged that it “should have waited until” after the deposition of Henry Ford’s representative
to evaluate whether summary disposition was appropriate with respect to Henry Ford.
Accordingly, the court entered an order granting in part and denying in part White’s motion for
reconsideration, setting aside the grant of summary disposition as it related to Henry Ford, but
denying the motion as it related to MRO.2
Henry Ford complied with the discovery orders and produced its keeper of records, Veeta
Montgomery, for a deposition. Thereafter, Henry Ford moved for summary disposition under
MCR 2.116(C)(8) and (10). It argued that White had failed to establish a factual dispute regarding
whether MRO’s fee was improper. Focusing on the MRAA and MCL 333.26269(1)(c), Henry
Ford argued that the Patient Rate was “limited to requests made by the patient for personal medical
use” and, therefore, any request outside those parameters was “not covered” and “left to the states.”
It also argue that White’s MCPA claim failed because of Slobin.
After White responded, mirroring many of his arguments in his response to MRO’s
dispositive motion, and a hearing, the trial court issued an opinion and order granting summary
disposition to Henry Ford. The court found that the Patient Rate did not apply because White’s
request was “made by a third-party.” It also found that there was no genuine factual dispute
regarding the reasonableness of the fees charged. This appeal followed.
II. STANDARD OF REVIEW
This Court reviews de novo a trial court’s decision on a motion for summary disposition.
El-Khalil v Oakwood Healthcare Inc, 504 Mich 152, 159; 934 NW2d 665 (2019). “A motion
under MCR 2.116(C)(8) tests the legal sufficiency of a claim based on the factual allegations in
the complaint.” Id. 159 (emphasis omitted). “When considering such a motion, a trial court must
accept all factual allegations as true, deciding the motion on the pleadings alone.” Id. at 160. “A
motion under MCR 2.116(C)(8) may only be granted when a claim is so clearly unenforceable that
no factual development could possibly justify recovery.” Id.A motion under MCR 2.116(C)(10) “tests the factual sufficiency of a claim.” El-Khalil,
504 Mich at 160 (citation and emphasis omitted). In considering a motion under MCR
2.116(C)(10), the trial court “must consider all evidence submitted by the parties in the light most
2
The trial court amended the order regarding reconsideration to include additional language
making it clear that it had reinstated the case.
-4-
favorable to the party opposing the motion.” Id. (citation omitted). Such a motion “may only be
granted when there is no genuine issue of material fact.” Id. (citation omitted). “A genuine issue
of material fact exists when the record leaves open an issue upon which reasonable minds might
differ.” Id. (quotation marks and citation omitted).
We review de novo questions of statutory interpretation. Yopek v Brighton Airport Ass’n,
Inc, ___ Mich App ___, ___; ___ NW2d ___ (2022) (Docket No. 359065); slip op at 3 (citation
omitted).
The goal of statutory interpretation is to determine and apply the intent of the
Legislature. The first step in determining legislative intent is to examine the
specific language of the statute. If the language is clear and unambiguous, judicial
construction is neither required nor permitted, and courts must apply the statute as
written. The provisions of a statute must be read in the context of the entire statute
to produce a harmonious whole. This Court must consider the object of the statute
and the harm it is designed to remedy, and apply a reasonable construction that best
accomplishes the statute’s purpose. [Id. at ___; slip op at 4-5 (quotation marks and
citations omitted).]
III. OVERVIEW OF THE STATUTES AND REGULATIONS GOVERNING MEDICAL
RECORD REQUESTS
This case requires an understanding of the interplay between the HITECH Act, HIPAA,
related federal regulations, the MRAA, and the effect of the Ciox decision on this case.3 We,
therefore, begin by reviewing the statutory and regulatory framework applicable to medical record
requests at issue in this appeal.
A. HIPAA AND THE PRIVACY RULE
Congress passed HIPAA in 1996 with the explicit purpose to “encourag[e] the
development of a health information system.” Ciox, 435 F Supp 3d at 38-39. It tasked the United
States Department of Health and Human Services (HHS) with recommending regulatory standards
related to protected health information, including regulations concerning an individual’s right to
access their protected health information. Id. (citations omitted). In 2000, HHS issued the
“Privacy Rule,” which established an individual’s right to access their medical records. Id.; see
45 CFR 164.524. It also established the fees that a “covered entity,”4 such as a hospital, could
charge for production of those records. Ciox, 435 F Supp 3d at 39; see 45 CFR 164.524. If an
3
Although not binding on state courts, lower federal court decisions may be considered for their
persuasive value. Abela v Gen Motors Corp, 469 Mich 603, 607; 677 NW2d 325 (2004). Although
Ciox has no precedential effect, its holding bears on the validity of the federal regulations at issue
in this case.
4
A “covered entity” includes “health plans, health care clearinghouses, and health providers that
“transmit[ ] any health information in electronic form in connection with a [covered] transaction.”
Ciox, 435 F Supp 3d at 39, quoting 45 CFR 160.103.
-5-
individual requests their own protected health information, also known as a “personal use request,”
the Privacy Rule allows a covered entity to “charge a reasonable, cost-based fee.” Ciox, 435 F
Supp 3d at 39. See 45 CFR 164.524(c)(4). The Ciox court referred to this “reasonable, cost-based
fee” as the “Patient Rate.” Ciox, 435 F Supp 3d at 39. As originally enacted, the Privacy Rule
provided that the Patient Rate could include the following elements: (1) the cost of copying the
protected health information, including the cost of supplies and labor for copying; (2) preparing
an explanation or summary of the protected health information; and (3) postage, if the individual
requests that the copy, summary, or explanation be mailed. Id.In addition to regulating “covered entities,” the Privacy Rule also regulates “business
associates”5 (though to a lesser extent than covered entities). Ciox Health, LLC, 435 F Supp 3d at
39. Under the definitions of “covered entity” and “business associate,” Henry Ford is a covered
entity (a health provider) and MRO is a business associate (offering health records to patients on
Henry Ford’s behalf).
The purpose of the Privacy Rule was to ensure individuals would not be deterred by cost
when seeking protected health information. See Ciox Health, LLC, 435 F Supp 3d at 40, citing
Standards for Privacy of Individually Identifiable Health Information, 65 Fed Reg 82,577
(December 28, 2020). But if the cost of obtaining and transmitting the health information was
borne by someone other than the patient, HHS did not require the Patient Rate. See id. (quoting
language from 65 Fed Reg at 82,577 indicating that HHS did “not intend to affect the fees that
covered entities charge for providing protected health information to anyone other than the
individual.”). See also id., quoting 65 Fed Reg at 82,754 (“The proposal and the final rule establish
the right to access and copy records only for individuals, not other entities; the ‘reasonable fee’ is
only applicable to the individual’s request.”). This demonstrates a distinction between protected
health information requested by a patient and such information requested by a non-patient. Id.The Patient Rate applies to protected health information requested by a patient, but not a non-
patient. Id. HHS’s “expectation [was] that other existing practices regarding fees, if any, for the
exchange of records not requested by an individual will not be affected by” the Privacy Rule. Ciox
Health, LLC, 435 F Supp at 40, quoting 65 Fed Reg at 82,754.
B. THE MICHIGAN MEDICAL RECORDS ACCESS ACT
In 2004, our Legislature passed the MRAA, which, in relevant part, provides a fee schedule
for medical record requests that are not covered by the Patient Rate. See MCL 333.26269(1). The
fee schedule is updated on an annual basis. See MCL 333.26269(6). The MRAA also includes a
provision allowing record providers to require prepayment of an applicable fee before sending
requested records: “A health care provider, health facility, or medical records company may refuse
5
Generally, a “business associate” operates on the covered entity’s behalf and “creates, receives,
maintains, or transmits protected health information for a [regulated] function or activity.” Id.(quotation marks and citation omitted). “Business associates include a ‘person that offers a
personal health record to one or more individuals on behalf of a covered entity’ and a
‘subcontractor that creates, receives, maintains, or transmits protected health information on behalf
of the business associate.’ ” Ciox Health, LLC, 435 F Supp 3d at 39.
-6-
to retrieve or copy all or part of a medical record for a patient or his or her authorized representative
until the applicable fee is paid.” MCL 333.26269(2).
C. THE HITECH ACT
In 2009, Congress passed the HITECH Act. Ciox Health, LLC, 435 F Supp 3d at 40. Two
provisions of the HITECH Act are particularly relevant here, 42 USC 17935(e)(1) and (3). See id.
at 40-41. With 42 USC 17935(e)(1), Congress created the “third-party directive,” which simplified
the “process for requesting delivery of certain [protected health information] to third persons.” Id.
at 40. “Under the pre-2009 Privacy Rule, a covered entity” could not release protected health
information “stored in any format to a third party” absent “valid authorization.” Id. Obtaining
that authorization was burdensome, and the HITECH Act “stripped away these requirements” as
it related to electronic health records.6 42 USC 17935(e)(1) provides:
In applying [45 CFR 164.524],[7] in the case that a covered entity uses or
maintains an electronic health record with respect to protected health information
of an individual—
(1) the individual shall have a right to obtain from such covered entity a
copy of such information in an electronic format and, if the individual chooses, to
direct the covered entity to transmit such copy directly to an entity or person
designated by the individual, provided that any such choice is clear, conspicuous,
and specific[.] [Footnote added.]
“So, with respect to [protected health information] contained in an [electronic health record], the
HITECH Act expressly entitles patients to obtain such information for themselves or to direct the
information to a third party, without the need for a ‘valid authorization’ under the Privacy Rule.”
Ciox Health, LLC, 435 F Supp 3d at 41.
With 42 USC 17935(e)(3), Congress imposed a statutory limit on the fee a covered entity
could charge a patient for delivering any electronically-held information. Ciox Health, LLC, 435
F Supp 3d at 41. 42 USC 17935(e)(3) provides:
[N]otwithstanding [45 CFR 164.524(c)(4) (providing allowable fees for labor,
supplies, and postage)],[8] any fee that the covered entity may impose for providing
6
An “electronic health record” is “an electronic record of health-related information on an
individual that is created, gathered, managed, and consulted by authorized health care clinicians
and staff.” 42 USC 17921(5).
7
White asserts that 45 CFR 164.524(b)(2)(i) is particularly relevant here. He argues that, under
that subsection of the regulation, defendants had 30 days to act on his record request. The language
of that particular regulation is provided in Section IV.A. of this opinion.
8
White asserts that 45 CFR 164.524(c)(3)(i) and (4) are also relevant here. He argues that 45 CFR
164.524(c)(4), entitled “Fees,” does not indicate that entities can require prepayment of a fee and
that, under 45 CFR 164.524(c)(3)(i), the entity must provide access in a timely manner.
-7-
such individual with a copy of such information (or a summary or explanation of
such information) if such copy (or summary or explanation) is in an electronic form
shall not be greater than the entity’s labor costs in responding to the request for the
copy (or summary or explanation). [Footnote added.]
The Ciox court indicated that, “[a]s the plain text makes clear, the HITECH Act’s fee cap applie[d]
at least to personal use requests produced as [electronic health records].” Ciox Health, LLC, 435
F Supp 3d at 41. “Whether the statutory fee cap extend[ed] beyond such demands [was] the subject
of dispute” at issue in Ciox. Id.
D. THE 2013 OMNIBUS RULE AND THE 2016 GUIDANCE
In 2013, HHS issued the 2013 Omnibus Rule, a broad set of regulations amending the
Privacy Rules. Ciox Health, LLC, 435 F Supp 3d at 41. One particular amendment expanded the
third-party mandate to include records in any format, not just electronic health records. Id. See
Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under
the Health Information Technology for Economic and Clinical Health Act and the Genetic
Information Nondiscrimination Act; Other Modifications to the HIPAA Rules, 78 Fed Reg 5,631
(January 25, 2013). In expanding the third-party mandate, HHS recognized it was “going beyond
the text of the HITECH Act” and conceded that the HITECH Act “ ‘applie[d] by its terms only to
protected health information in [electronic health records].” Ciox Health, LLC, 435 F Supp 3d at
41, quoting 78 Fed Reg 5,631. The 2013 Omnibus Rule also amended the portion of the Privacy
Rule that specified the costs recoverable under the Patient Rate, and when that rate applied. Ciox
Health, LLC, 435 F Supp 3d at 42. It “broke out, as part of the reasonable cost-based fee, the cost
of labor for copying [protected health information], whether in paper or electronic format,” which
could include time spent by skilled technical staff to create and copy electronic files. Id. (citations
omitted). But the actual cost of labor “associated with the retrieval of electronic information” was
not recoverable under the Patient Rate, nor were fees associated with maintaining systems, data
access, storage, and infrastructure. Id. (quotation marks and citations omitted).
Then, in 2016, HHS issued the 2016 Guidance. Particularly relevant here, HHS, through
the 2016 Guidance, declared that the Patient Rate applied “when an individual directs a covered
entity to send the [protected health information] to a third party.” Ciox Health, LLC, 435 F Supp
3d at 42 (citation omitted). In other words, the Patient Rate applied “regardless of whether the
individual ha[d] requested that the copy of [protected health information] be sent to herself, or has
directed that the covered entity send the copy directly to a third party designated by the individual
(and it doesn’t matter who the third party is).” Id. (quotation marks and citations omitted). The
2016 Guidance also noted that the Patient Rate did not apply when the third party initiated a request
for protected health information on its own behalf, with the individual’s HIPAA authorization. Id.
(citation omitted). HHS stressed, however, that when the third party forwarded the individual’s
record request for a covered entity to send a copy of the protected health information to the third
party (on the individual’s behalf and at their direction), the fee limitations applied. Id. (citation
omitted).
The 2016 Guidance also gave direction for determining the Patient Rate. Ciox Health,
LLC, 435 F Supp 3d at 43. It limited the Patient Rate to labor costs incurred after the protected
health information requested was identified, retrieved, and compiled, and was ready to be copied.
-8-
Id. (citations omitted). The 2016 Guidance also provided three alternatives for calculating the
reasonable, cost-based fee that could be charged when a patient initiated a protected-health-
information request, and that applied to a covered entity or business associate. Id. (citation
omitted). The holder of protected health information could determine the fee by (1) calculating
actual allowable costs for fulfilling each request; (2) using a schedule of costs based on average
allowable labor costs in fulfilling standard requests; or (3) in cases involving requests for electronic
copies of protected health information maintained electronically, covered entities could charge a
flat fee not to exceed $6.50 (which includes all labor, supplies, and postage). Id. (citations
omitted). The third option, the flat fee not to exceed $6.50, was an option available to entities that
did not want to “go through the process of calculating actual or average allowable costs for requests
for electronic copies of [protected health information] maintained electronically.” Id. (quotation
marks and citation omitted).
E. CIOX HEALTH, LLC V AZAR
In Ciox Health, LLC v Azar, the United States District Court for the District of Columbia
vacated the 2016 Guidance to the extent that it extended the Patient Rate to third-party directive
requests. See Ciox Health, LLC, 435 F Supp 3d at 68-69 (addressing challenges to the 2013
Omnibus Rule and 2016 Guidance under the Administrative Procedure Act, 5 USC 706). The
court stated:
The HITECH Act on its face applies the Patient Rate only to individual requests for
[protected health information] in electronic form, and the 2013 Omnibus Rule says
nothing at all about the Patient Rate’s application. Indeed, the 2016 Guidance
represents an about-face from HHS’s proclamation, made in 2000 when it first
adopted the Privacy Rule and the Patient Rate, that “[w]e do not intend to affect the
fees that covered entities charge for providing protected health information to
anyone other than the individual,” 65 Fed Reg at 82,557 (emphasis added), and
“[t]he proposed and final rule establish the right to access and copy records only
for individuals, not other entities; the ‘reasonable fee’ is only applicable to the
individual’s request,” id. at 82,754 (emphasis added); see also id. (“The
Department’s expectation is that other existing practices regarding fees, if any, for
the exchange of records not requested by an individual will not be affected by this
rule.”). [Id. at 66-67.]
And in late January 2020, HHS issued a statement regarding the guidelines and the effect of the
Ciox decision, stating:
On January 25, 2013, HHS published a final rule entitled “Modifications to
the HIPAA Privacy, Security, and Enforcement Rules Under the Health
Information Technology for Economic and Clinical Health Act, and the Genetic
Information Nondiscrimination Act; Other Modifications to the HIPAA Rules.”
(2013 Omnibus Rule). A portion of that rule was challenged in federal court,
specifically provisions within 45 CFR 164.524, that cover an individual’s access to
protected health information. On January 23, 2020, a federal court vacated the
“third-party directive” within the individual right of access “insofar as it expands
the HITECH Act’s third-party directive beyond requests for a copy of an electronic
-9-
health record with respect to [protected health information] of an individual . . . in
an electronic format.” Additionally, the fee limitation set forth at 45 CFR
164.524(c)(4) will apply only to an individual’s request for access to their own
records, and does not apply to an individual’s request to transmit records to a third
party.
The right of individuals to access their own records and the fee limitations
that apply when exercising this right are undisturbed and remain in effect. OCR
will continue to enforce the right of access provisions in 45 CFR 164.524 that are
not restricted by the court order. [United States Department of Health and Human
Services, Important Notice Regarding Individuals’ Right of Access to Health
Records
(accessed April 7, 2023).]
IV. CONFLICT BETWEEN THE MRAA AND THE HITECH ACT
A. DEFENDANTS HAD 30 DAYS TO GRANT OR DENY WHITE’S RECORD REQUEST
Against this statutory and regulatory backdrop, White argues that defendants failed to
comply with the 30-day requirement in the HITECH Act. We agree.
In arguing that defendants had to send his records within 30 days, White relies on 42 USC
17935(e)(1) and 45 CFR 164.524(b)(2). As stated, 42 USC 17935(e)(1) provides:
In applying [45 CFR 164.524], in the case that a covered entity uses or
maintains an electronic health record with respect to protected health information
of an individual—
(1) the individual shall have a right to obtain from such covered entity a
copy of such information in an electronic format and, if the individual chooses, to
direct the covered entity to transmit such copy directly to an entity or person
designated by the individual, provided that any such choice is clear, conspicuous,
and specific[.] [Footnote added.]
45 CFR 164.524(b)(2)(i) provides, in relevant part:
(b) Implementation specifications: requests for access and timely action.
* * *
(2) Timely action by the covered entity.
(i) Except as provided in paragraph (b)(2)(ii) of this section, the covered
entity must act on a request for access no later than 30 days after receipt of the
request as follows.
(A) If the covered entity grants the request, in whole or in part, it must
inform the individual of the acceptance of the request and provide the access
requested, in accordance with paragraph (c) of this section.
-10-
(B) If the covered entity denies the request, in whole or in part, it must
provide the individual with a written denial, in accordance with paragraph (d) of
this section.
See also 45 CFR 164.524(c)(3) (regarding time and manner of access and referencing 45 CFR
164.524(b)(2)). White asserts that the HITECH Act and the relevant regulations, therefore,
control, and defendants had 30 days to act on his record request.
We agree with White. The Ciox court stated that “with respect to [protected health
information] contained in an [electronic health record], the HITECH Act expressly entitles patients
to obtain such information for themselves or to direct the information to a third party . . . .” Ciox
Health, LLC, 435 F Supp 3d at 41. White, therefore, was entitled to obtain his protected health
information that was contained in an electronic health record for himself, or to direct it to a third
party (here, his attorney, Sitto).9 Based on 45 CFR 164.524(b)(2)(i), defendants had to act on
White’s record request “no later than 30 days after receipt of the request . . . .” Defendants did not
comply with this mandate. White signed his record request on February 1, 2021, and MRO
indicated that it received the request on February 2, 2021. On February 3, 2021, MRO processed
the request and generated the invoice for $54.56. The February 3, 2021 letter from MRO explained
that the records would be sent to Sitto “upon receipt of your payment.” Although MRO essentially
granted the request for access to White’s records, it conditioned transmission of the records on
payment of the invoice, meaning defendants granted the request but potentially would never
provide the access requested. Defendants, therefore, failed to comply with either prong of 45 CFR
164.524(b)(2)(i), which requires that a covered entity either grant the request and provide the
access requested, see 45 CFR 164.524(b)(2)(i)(A), or deny the request and provide the individual
with a written denial, see 45 CFR 164.524(b)(2)(i)(B).
B. THE HITECH ACT FEDERALLY PREEMPTS THE MRAA
Defendants did not comply with the 30-day requirement because they believed that MCL
333.26269(2) allowed them to withhold White’s records until he paid the applicable fee. White is
correct in asserting that the HITECH Act does not contain any language allowing conditioning
transmission of records on the prepayment of a fee. But, as defendants note, MCL 333.26269(2)
allows health care providers and medical record companies to “refuse to retrieve or copy all or part
of a medical record for a patient or his or her authorized representative until the applicable fee is
paid.” White argues, however, that MCL 333.26269(2) conflicts with the HITECH Act and the
relevant regulations such that federal law preempts the MRAA on this issue. Specifically, he
argues that the requirement that a request for records be granted or denied within 30 days under
federal law is inconsistent with the language in MCL 333.26269(2) allowing health care providers
or medical record companies to condition transmission of records on prepayment of the applicable
fee. We agree with White.
9
As discussed later in this opinion, however, this does not mean that the HITECH Act and related
regulations control the fee that may be imposed.
-11-
In In re Schultz, 334 Mich App 730, 737-738; 965 NW2d 741 (2020), this Court explained
the considerations for evaluating a claim of federal preemption:
Under the Supremacy Clause of the United States Constitution, US Const,
art VI, cl 2, federal law preempts state law where Congress so intends. Federal law
preempts state law in three circumstances: (1) where Congress has expressed an
intent to preempt state law, (2) where state law regulates conduct in a field that
Congress intended to occupy exclusively, and (3) where state law actually conflicts
with federal law. In all pre-emption cases, and particularly in those in which
Congress has legislated . . . in a field which the States have traditionally occupied,
we start with the assumption that the historic police powers of the States were not
to be superseded by the Federal Act unless that was the clear and manifest purpose
of Congress. [Quotation marks, citations, and brackets omitted.]
As noted, under 45 CFR 164.524(b)(2)(i), a covered entity “must act on a request for access
[to medical records] no later than 30 days after receipt of the records” in one of two ways. If the
covered entity grants the record request, “in whole or in part, it must inform the individual of the
acceptance of the request and provide the access requested, in accordance with paragraph (c) of
this section.” 45 CFR 164.524(b)(2)(i)(A). But if the entity denies the request, “in whole or in
part, it must provide the individual with a written denial, in accordance with paragraph (d) of this
section.” 45 CFR 164.524(b)(2)(i)(B). See also 45 CFR 164.524(b)(2)(ii) (allowing covered entity
to extend the time to act by no more than 30 days, provided two conditions are met). Accordingly,
45 CFR 164.524(b)(2)(i) requires a covered entity to either grant or deny a record request within
30 days of receiving it (unless it extends the time for doing so by no more than 30 days).
This plainly conflicts with MCL 333.26269(2). That provision allows a health care
provider or medical record company (like Henry Ford and MRO) to condition release of records
on prepayment of an applicable fee. Payment of that fee, however, might not occur until past the
30-day mark required under federal law. The MRAA, therefore, “actually conflicts” with the
HITECH Act and its associated regulations that require a grant or denial within 30 days. In re
Schultz, 334 Mich App at 737. Accordingly, the HITECH Act preempts the MRAA to the extent
it circumvents the 30-day requirement.
In his brief on appeal, White references 45 CFR 160.203 as supporting his contention that
federal law preempts state law here. That particular section of the Code of Federal Regulations
relates to preemption of state law. Relevant here, it states:
A standard, requirement, or implementation specification adopted under
this subchapter that is contrary to a provision of State law preempts the provision
of State law. This general rule applies, except if one or more of the following
conditions is met:
(a) A determination is made by the Secretary under § 160.204 that the
provision of State law:
(1) Is necessary:
-12-
(i) To prevent fraud and abuse related to the provision of or payment for
health care;
(ii) To ensure appropriate State regulation of insurance and health plans to
the extent expressly authorized by statute or regulation;
(iii) For State reporting on health care delivery or costs; or
(iv) For purposes of serving a compelling need related to public health,
safety, or welfare, and, if a standard, requirement, or implementation specification
under part 164 of this subchapter is at issue, if the Secretary determines that the
intrusion into privacy is warranted when balanced against the need to be served; or
(2) Has as its principal purpose the regulation of the manufacture,
registration, distribution, dispensing, or other control of any controlled substances
(as defined in 21 U.S.C. 802), or that is deemed a controlled substance by State law.
(b) The provision of State law relates to the privacy of individually
identifiable health information and is more stringent than a standard, requirement,
or implementation specification adopted under subpart E of part 164 of this
subchapter. [45 CFR 160.203(a) and (b).]
This regulation supports the conclusion that the HITECH Act preempts state law to the
extent it is inconsistent with the 30-day requirement. Under 45 CFR 160.203 generally, any
standard, requirement, or implementation specification adopted that is contrary to state law
preempts that provision of state law. But if the state law provision “relates to the privacy of
individually identifiable health information and is more stringent than a standard, requirement, or
implementation specification adopted under subpart E of part 164 of this subchapter,” then the
state law provision is not preempted. 45 CFR 160.203(b). Subpart E of part 164 of this subchapter
relates to “Privacy of Individually Identifiable Health Information” and includes 45 CFR 164.500
through 164.534. Notably, 45 CFR 164.524, discussed earlier, is included. Accordingly, if MCL
333.26269 were “relate[d] to the privacy of individually identifiable health information” and it
were “more stringent than” a provision of 45 CFR 164.524, then MCL 333.26269 would not be
preempted.
Under 45 CFR 160.202, “relates to the privacy of individually identifiable health
information” means “with respect to a State law, that the State law has the specific purpose of
protecting the privacy of health information or affects the privacy of health information in a direct,
clear, and substantial way.” That subpart also defines “contrary” and “more stringent” as used in
45 CFR 160.203:
Contrary, when used to compare a provision of State law to a standard,
requirement, or implementation specification adopted under this subchapter,
means:
(1) A covered entity or business associate would find it impossible to
comply with both the State and Federal requirements[.]
-13-
* * *
More stringent means, in the context of a comparison of a provision of State
law and a standard, requirement, or implementation specification adopted under
subpart E of part 164 of this subchapter, a State law that meets one or more of the
following criteria:
* * *
(2) With respect to the rights of an individual, who is the subject of the
individually identifiable health information, regarding access to or amendment of
individually identifiable health information, permits greater rights of access or
amendment, as applicable.
Based on these definitions and the language of 45 CFR 160.203, federal law preempts MCL
333.26269(2). The prepayment requirement in MCL 333.26269(2) is less stringent than federal
law with respect to the degree of access it provides an individual with access to their individually
identifiable health information. That is, MCL 333.26269(2) provides less access to the
individually identifiable health information than 42 USC 17935(e)(1) and 45 CFR
160.524(b)(2)(i). Federal law requires that covered entities provide access to requested records
within 30 days of the request (if granting the request). MCL 333.26269(2), on the other hand, has
no time limitations and allows health care providers and medical record companies to withhold
records until the requesting individual pays any applicable fees. This could extend well beyond
the 30 days required by federal law (and beyond the additional 30 days allowed as an extension).
Accordingly, 45 CFR 160.203 supports a finding of federal preemption.
V. STATE LAW APPLIES TO DETERMINING THE FEE DEFENDANTS COULD IMPOSE
FOR PROVIDING COPIES OF MEDICAL RECORDS
White argues that the trial court erred when it found that state law, not federal law, applied
for purposes of determining the fee defendants could impose for providing copies of his records.
We disagree.
In Ciox, the federal district court vacated the 2013 Omnibus Rule “insofar as it expand[ed]
the HITECH Act’s third-party directive beyond requests for a copy of ‘[electronic health records]
with respect to [protected health information] of an individual . . . in an electronic format,” and the
2016 Guidance to the extent it “extend[ed] the Patient Rate to reach third-party directives.” Ciox
Health, LLC, 435 F Supp 3d at 68-69. The Ciox court found that the plain language of the HITECH
Act’s fee limitation related to providing protected health information in electronic form to a
requesting individual, not a third party:
The HITECH Act does not speak to the allowable fees for [protected health
information] that a person directs to a third party. Rather, the Act provides that,
“[i]n applying [45 CFR 164.524],” “notwithstanding paragraph (c)(4) of such
section, any fee that the covered entity may impose for providing such individual
with a copy of such information . . . if such copy . . . is in an electronic form shall
not be greater than the entity’s labor costs in responding to the request for the copy.”
42 U.S.C. § 17935(e)(3) (emphasis added). Thus, the plain text of the HITECH
-14-
Act’s fee limit concerns “providing” [protected health information] in electronic
form to “such individual,” not to a third party. Id. This reading is buttressed by the
neighboring statutory language used to create the third-party directive, which
provides that individuals shall have the right . . . “to direct the covered entity to
transmit such copy direct to an entity or person designated by the individual,” i.e.,
a third party. Id. § 17935(e)(1). Congress thus clearly understood how to reference
third parties in the HITECH Act when it wanted to but elected not to do so when
establishing the fee limitation. Also, it stands to reason that, by expressly
referencing the existing Patient Rate regulation, Congress did not intend to modify
the then-existing scope of the Patient Rate, which, since its inception in 2000,
applied only to delivery of [protected health information] to the individual
requester, and not to third parties. If Congress had intended to expand the Patient
Rate beyond its original parameters, the court would have expected it to say so more
clearly. [Ciox Health, LLC, 435 F Supp 3d at 58.]
The Patient Rate, therefore, applies only to requests for protected health information that
are to be sent directly to the patient, not a third party. See Ciox Health, LLC, 435 F Supp 3d at 58,
66-69. See also United States Department of Health and Human Services, Important Notice
Regarding Individuals’ Right of Access to Health Records (accessed April 7, 2023) (“[T]he fee limitation set forth at 45
CFR 164.524(c)(4) will apply only to an individual’s request for access to their own records, and
does not apply to an individual’s request to transmit records to a third party.”).
Here, White requested that his records be sent electronically to his attorney, Sitto. He had
the right to do this. See Ciox Health, LLC, 435 F Supp 3d at 41 (“[T]he HITECH Act expressly
entitles patients to obtain such information for themselves or to direct the information to a third
party . . . .”). But because the fee limitation in the HITECH Act applies only to medical records
directed to patients, not third parties, defendants10 were not limited to imposing a fee based on
their labor costs for producing the records. See Ciox Health, LLC, 435 F Supp 3d at 58 (“[S]ince
its inception in 2000, [the Patient Rate] applied only to delivery of [protected health information]
to the individual requester, and not to third parties”). Instead, HHS’s “expectation [was] that other
10
Many of the regulations at issue, including 45 CFR 164.524(b) and (c), refer only to “covered
entities,” not “business associates.” As noted earlier, MRO qualifies as a “business associate.” Cf
Ciox Health, LLC, 435 F Supp 3d at 39 (finding that the plaintiff, Ciox Health, qualified as a
“business associate.”). Even so, “HHS’s regulations all but ensure that business associates will
limit the fees they charge in a manner consistent with HHS’s interpretation of the [restrictions
imposed by the regulations]. The regulations make expressly covered entities liable for their
business associates’ violations.” Id. at 49; see id. at 49-50 (noting that covered entities have
“structured their contracts to require their business associates to follow the regulations” and
indicating that Ciox Health’s contracts “include[d] provisions requiring Ciox to indemnify the
covered entity for any violation . . . that is attributable to the covered entity for Ciox’s
actions . . . .”) (citation omitted); see also Schutte v Ciox Health, LLC, 28 F4th 850, 857 n 2 (CA
7, 2022) (providing language from Ciox, 435 F Supp 3d at 30, referenced in this footnote). Further,
White’s initial request was directed at Henry Ford, not MRO.
-15-
existing practices regarding fees, if any, for the exchange of records not requested by an individual
will not be affected by this rule.” Id. at 40, quoting 65 Fed Reg at 82,754. Defendants, therefore,
could charge White for his records based on existing state law related to such requests—MCL
333.26269(1).
MCL 333.26269(1) governs fees a health care provider or medical records company may
charge for medical record requests. It provides:
(1) Except as otherwise provided in this section, if a patient or his or her
authorized representative makes a request for a copy of all or part of his or her
medical record under section 5, the health care provider, health facility, or medical
records company to which the request is directed may charge the patient or his or
her authorized representative a fee that is not more than the following amounts:
(a) An initial fee of $20.00 per request for a copy of the record.
(b) Paper copies as follows:
(i) One dollar per page for the first 20 pages.
(ii) Fifty cents per page for pages 21 through 50.
(iii) Twenty cents for pages 51 and over.
(c) If the medical record is in some form or medium other than paper, the
actual cost of preparing a duplicate.
(d) Any postage or shipping costs incurred by the health care provider,
health facility, or medical records company in providing the copies.
(e) Any actual costs incurred by the health care provider, health facility, or
medical records company in retrieving medical records that are 7 years old or older
and not maintained or accessible on-site. [MCL 333.26269(1).]
Two years after the effective date of the MRAA (April 1, 2004), “the department of community
health shall adjust on an annual basis the fees prescribed by subsection (1) by an amount
determined by the state treasurer to reflect the cumulative annual percentage change in the Detroit
consumer price index.” MCL 333.26269(6).
Here, White requested his records be provided in electronic format only and sent directly
to his attorney, Sitto. MRO responded to White’s request with an invoice charging him $54.56 for
26 pages of records. This total balance included a $25.38 search-and-retrieval fee, $25.40 for “Tier
1” pages printed and $3.78 for “Tier 2” pages printed. The adjusted numbers are based on the
2020 MRAA fee schedule for paper copies, produced pursuant to MCL 333.26269(6). MRO
charged White based on the fee for paper copies. Given that White requested his records in
electronic format, this was improper. Instead, MRO was limited to charging White the initial fee
per request for a copy of the record, MCL 333.26269(1)(a), and the actual cost of preparing a
duplicate, as the medical record was in a form or medium other than paper (electronic).
-16-
The $25.38 initial fee that MRO charged was, therefore, appropriate. The fees based on
the number of pages printed, however, were not. The only additional fee that could be charged
was the actual cost of preparing a duplicate. The trial court erred in finding the fee charged based
on pages printed was appropriate. We, therefore, remand to the trial court for it to determine
appropriate fee based on the actual cost of preparing a duplicate record.
VI. WHITE’S MCPA CLAIM IS BARRED BECAUSE HE REQUESTED HIS MEDICAL
RECORDS FOR LITIGATION PURPOSES
White argues that the trial court erroneously dismissed his MCPA claim under the mistaken
notion that Slobin, 469 Mich at 211, barred that claim. We disagree.
“The MCPA provides protection to Michigan’s consumers by prohibiting various methods,
acts, and practices in trade or commerce.” Slobin v Henry Ford Health Care, 469 Mich 211, 215;
666 NW2d 632 (2003). White alleged that defendants’ withholding of his medical records violated
MCL 445.903(1)(n), (q), and (z), which provide:
(1) Unfair, unconscionable, or deceptive methods, acts, or practices in the conduct
of trade or commerce are unlawful and are defined as follows:
* * *
(n) Causing a probability of confusion or of misunderstanding as to the legal rights,
obligations, or remedies of a party to a transaction.
* * *
(q) Representing or implying that the subject of a consumer transaction will be
provided promptly, or at a specified time, or within a reasonable time, if the
merchant knows or has reason to know it will not be so provided.
* * *
(z) Charging the consumer a price that is grossly in excess of the price at which
similar property or services are sold.
With respect to MCL 445.903(1)(z), the claim of improper charging, our Supreme Court has stated
that “[s]uch improper charging is only unlawful under the act, however, ‘in the conduct of trade or
commerce’ as defined in the act.” Slobin, 469 Mich at 216. The MCPA defines “trade or
commerce” as the “conduct of a business providing goods, property, or service primarily for
personal, family, or household purposes.” MCL 445.902(1)(g), as amended by 2006 PA 508. See
also Slobin, 469 Mich at 216 (noting the definition of “trade or commerce” which was, at the time
Slobin was decided, defined under MCL 445.902(1)(d)).11
11
For purposes of this case, the definition of “trade or commerce” remained essentially unchanged.
-17-
In Slobin, our Supreme Court confronted the question of whether a claim could be sustained
under the MCPA based on a law firm’s request for its clients’ medical records. Slobin, 469 Mich
at 212-213. The Court held that it could not:
[A] claim for damages based upon a law firm’s request for the medical records of
a client it is representing in litigation cannot be sustained under the MCPA. Such
a claim fails as a matter of law because obtaining medical records for the purpose
of litigation is not ‘primarily for personal, family, or household use,’ as required by
the act. [Id. at 218.]
The trial court did not err when it dismissed White’s MCPA claim. White argues that he
did not seek the records for litigation purposes, but rather, “for personal purposes for his personal
injury claim” and that he simply “sought to restore himself, personally, to his pre-accident status.”
White attempts to distinguish his case from Slobin by arguing that Slobin involved a law firm
requesting the medical records for “a business purpose,” but, here, “White requested his record be
sent to his lawyer,” i.e., “[i]t was White’s request, not his lawyer’s request.” Regardless of how
White characterizes the request, it was for the purpose of litigation. In fact, in his responses to the
dispositive motions of both MRO and Henry Ford, White admitted that he sought his medical
records for litigation purposes. Both responses contained the following language: “White sought
to make a bodily injury claim against the at-fault driver and retained Auto Accident Attorneys,
PLLC. In order to properly pursue his personal injury claim, White needed his medical record
from Henry Ford.” The fact that White was pursuing a personal injury claim does not mean his
record request was for personal purposes; to pursue that claim, he had to initiate litigation. Under
Slobin, when an individual seeks records for litigation purposes, a claim under the MCPA cannot
be sustained. Slobin, 469 Mich at 218. The trial court, therefore, did not err in dismissing White’s
MCPA claim.
VII. CONCLUSION
Defendants failed to act on White’s request for his medical records within 30 days, as they
were required to under the HITECH Act and related regulations, because they believed that MCL
333.26269(2) allowed them to withhold White’s records until he paid the applicable fee. That
prepayment provision conflicts with the 30-day requirement under the HITECH Act, so the
HITECH Act’s 30-day requirement preempts the MRAA’s prepayment provision. Still, state law
applies for purposes of determining the fee defendants could impose for providing White’s records.
The trial court correctly applied state law when determining the proper fee, but erred when it found
that MRO charged White an appropriate fee: because White requested his records in electronic
format, defendants improperly charged him for paper copies. And when medical records are
obtained for litigation purposes, as White essentially admits they were here, the MCPA does not
apply. The trial court, therefore, properly dismissed White’s MCPA claim.
Accordingly, for the reasons stated in this opinion, we affirm in part, reverse in part, and
remand for further proceedings. We do not retain jurisdiction.
/s/ Noah P. Hood
/s/ Kristina Robinson Garrett
/s/ Kirsten Frank Kelly
-18-