A Virginia hospital can ask a plaintiff to cover the cost of a hospital employee to assist the plaintiff’s lawyer in navigating an online portal for a client’s medical records, a Norfolk Circuit Court has ruled.
Citing federal regulations under the Health Information Portability and Accountability Act, the plaintiff’s lawyer argued that the client was not liable to the nonparty hospital for the cost of a hospital staff person’s time, which the hospital set at a $57 hourly rate.
The med-mal plaintiff said the nonparty hospital, the Children’s Hospital of the King’s Daughters, violated HIPAA by assessing a cost for access to the patient’s electronic health record.
But the circuit court said it could not authorize a remedy for the hospital’s alleged HIPAA violation, and that Virginia rules on discovery of electronic medical records would allow the hospital to recover a “reasonable” fee for viewing the records through the hospital’s “provider portal.”
Judge Mary Jane Hall issued her decision in Lewis v. Kushner (VLW 017-8-009) on Jan. 4.
‘Provider portal’ access
The medical malpractice plaintiff is a minor child who is suing a physician, by his mother and next friend. The plaintiff’s lawyer argued that the hospital’s “provider portal” allowed access to its entire electronic health record, or EHR, permitting a viewer to see what a provider would see when putting information in the EHR, according to Hall’s opinion.
Under federal HIPAA regulations, the hospital could not condition access to the online portal upon the plaintiff’s payment for a hospital employee’s time, according to motions filed by Virginia Beach lawyer Judith A. Cofield, who represented the plaintiff.
CHKD said it already had provided copies of medical and billing records, audit trails, imaging and pathology samples in the matter, and it did not object to providing access to the patient portal. Rather, the hospital objected to the staff time that would necessarily be diverted to provide the access the plaintiff sought.
Hall agreed with the hospital that HIPAA does not provide for a private cause of action and is not enforceable through court action.
“This Court has no authority to offer a remedy to a litigant who claims that a provider has violated HIPAA by assessing a cost for access to its electronic health record,” Hall wrote.
The court said HIPAA “does not require CHKD to permit the access that Plaintiff seeks” and further concluded “that a reasonable cost is allowable” under Virginia Supreme Court Rule 4:9A, which governs production of electronically stored information, or ESI, from a nonparty.
Rule 4:9A(c)(2) provides for production of ESI from a nonparty provided the information is reasonably accessible and does not create an undue burden or cost, Hall said. The rules also say patient health records with privacy protections under Virginia’s Health Records Privacy Act, Va. Code § 32.1-127.1:03, are to be disclosed only in accordance with that statute.
Under the Virginia health records statute, the provider portal version of the client’s records was not “reasonably available without additional cost” to CHKD, and the hospital employee had to be present to help navigate the system and because the portal records were “subject to modification” in that format.
Pursuant to Rule 4:9A(c) and the statute incorporated by reference, CHKD “is not required to allow access through the provider portal,” Hall wrote. And “nothing in HIPAA requires a health care provider to have or allow access through a portal of any type, let alone a provider portal,” the court said.
Hall concluded the hospital could request a fee prior to granting access, but deferred making any determination of whether the $57 hourly fee cited by the hospital was in fact reasonable.
The hospital was represented by Richmond lawyer Ruth T. Griggs. Neither Cofield nor Griggs could offer comment by press time.