Cross v. Ciox Health, LLC

• Decision Date: 03 February 2020
• Docket Number: NO. 4:19-CV-7-FL,4:19-CV-7-FL
• Citation: 438 F.Supp.3d 572
• Court: U.S. District Court — Eastern District of North Carolina
• Parties: Lakiesha CROSS as parent and natural guardian of S.C., a minor, Earlene Dunbar, Ernest Sprueill, Erica Higgins-Ingram, and Lynette Blake, individually and on behalf of all those similarly situated, Plaintiffs, v. CIOX HEALTH, LLC, Defendant.

438 F.Supp.3d 572

Lakiesha CROSS as parent and natural guardian of S.C., a minor, Earlene Dunbar, Ernest Sprueill, Erica Higgins-Ingram, and Lynette Blake, individually and on behalf of all those similarly situated, Plaintiffs,

v.CIOX HEALTH, LLC, Defendant.

NO. 4:19-CV-7-FL

United States District Court, E.D. North Carolina, Eastern Division.

Signed February 3, 2020

Eric N. Linsk, Robert K. Shelquist, Lockridge Grindal Nauen PLLP, Minneapolis, MN, J. Olin McDougall, II, McDougall Law Firm, LLC, Beaufort, SC, Christopher C. Kessler, The Kessler Law Firm, PLLC, Greenville, NC, for Plaintiffs Lakiesha Cross, Earlene Dunbar, Ernest Sprueill, Erica Higgins-Ingram.

Christopher C. Kessler, The Kessler Law Firm, PLLC, Greenville, NC, Eric N. Linsk, Robert K. Shelquist, Lockridge Grindal Nauen PLLP, Minneapolis, MN, for Plaintiff Lynette Blake.

Christopher S. Edwards, Ward and Smith, P.A., Wilmington, NC, Donalt J. Eglinton, Ward and Smith, P.A., New Bern, NC, Jennifer B. Dempsey, William V. Custer, Bryan Cave Leighton Paisner LLP, Atlanta, GA, for Defendant.

ORDER

LOUISE W. FLANAGAN, United States District Judge This matter is before the court upon defendant's motions to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(1) and 12(b)(6) (DE 31, 33). The motions have been briefed fully and the issues raised are ripe for ruling. For the following reasons, defendant's motion under Rule 12(b)(1) is denied and its motion under Rule 12(b)(6) is granted.

STATEMENT OF THE CASE

Plaintiffs commenced this putative class action on January 11, 2019, and filed the operative amended complaint on April 4, 2019, asserting claims under North Carolina law against defendant for overcharging them for their medical records in violation of standards set forth in the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the Health Information Technology for Economic and Clinical Health Act ("HITECH"), 42 U.S.C. § 300jj-11, and their implementing regulations governing fees for provision of medical records. Plaintiffs assert claims under the North Carolina Unfair and Deceptive Trade Practices Act ("UDTPA"), N.C. Gen. Stat. § 75-1.1 et seq., as well as common law claims for negligent misrepresentation and unjust enrichment. Plaintiffs seek declaratory and injunctive relief, as well as damages, including trebled and punitive damages, on behalf of themselves and a proposed class, in an amount in excess of $5,000,000.00. Plaintiffs assert subject matter jurisdiction over this matter under the Class Action Fairness Act, 28 U.S.C. § 1332(d).

Defendant filed the instant motions to dismiss on May 10, 2019, seeking dismissal of plaintiffs' claims for lack of subject matter jurisdiction and for failure to state a claim.¹ In support of the motions, defendant relies upon a declaration of Jason Martin, defendant's vice president of credit and collections, attaching requests for records and invoices relating to plaintiffs. Defendant also relies upon an order in a civil action in the Superior Court of Fulton County, Georgia, captioned Roscoe v. Ciox Health LLC f/k/a HealthPort Technologies, LLC, No. 2018CV305235 (March 4, 2019).

Plaintiffs responded in opposition to defendant's Rule 12(b)(1) motion to dismiss on June 13, 2019. Plaintiffs responded in opposition to defendant's Rule 12(b)(6) motion to dismiss the next day, relying upon an affidavit of Eric N. Linsk, one of plaintiffs' attorneys, attaching notices of electronic filing and an order in a civil action in the Circuit Court for Hillsborough County, Florida, captioned Allen v. Healthport Technologies, LLC, No. 12-CA-013154 (Nov. 19, 2014).

Defendant filed replies in support of its motions on July 8, 2019. On December 13, 2019, the court granted defendant leave to file a notice of subsequently decided authority, and plaintiffs filed a response thereto on December 19, 2019. On February 3, 2020, defendant filed a second notice of subsequently decided authority.

STATEMENT OF ALLEGED FACTS

The facts alleged in the operative complaint² may be summarized as follows. Plaintiffs are residents of this district. Defendant was formerly known as and operated as HealthPort Technologies, LLC and/or HealthPort Incorporated and changed its name to Ciox Health in March 2016. According to the complaint, defendant is "a specialized medical-records provider that contracts with healthcare providers in all 50 states to retrieve and release individuals' PHI [personal health information] under HIPAA and relevant state privacy laws." (Compl. ¶ 22). Defendant allegedly "provides medical-record retrieval services for three out of five hospitals in the United States and more than 16,000 physician practices, and handles more than 40 million medical-record requests annually." (Id. ¶ 23).

According to the complaint, defendant "manages the process of responding to a medical-records request for its hospital and clinic clients, including receiving the request, locating responsive documents, providing a response to the patient, invoicing the patient, and collecting payment." (Id. ¶ 46). Defendant allegedly "advertises itself as providing a prompt and complete response to medical records requests, claiming that it can provide cost reduction to individuals requesting medical records due to its use of electronic delivery of medical records which allows requesters to view records and only print the ones you want to use." (Id. ¶ 48 (internal quotations omitted)).

According to the complaint, defendant "sends out [a] patient's requested medical records with its invoice," allegedly "overcharging for such records." (Id. ¶ 49). "For electronic deliveries of medical records, [defendant] routinely charges" a "basic fee of $5.00 or $10.00; a retrieval fee of $5.00; a $2.00 electronic data archive fee[;] and per-page copy fees even when no paper copies are being provided to the requester." (Id. ¶ 50). Plaintiffs assert in the complaint that such fees are "improper and unlawful." (Id. ).

Plaintiffs allege that defendant is aware that a federal law "Privacy Rule" "permits covered entities to impose only reasonable, cost-based fees to provide individuals (or their designated recipient) with copies of their medical records." (Id. ¶ 51). According to plaintiffs, the "Privacy Rule" is a "privacy standard[ ] for health information" published by the United States Department of Health and Human Services ("HHS") in 2000, "in accordance with instructions from Congress flowing from HIPAA." (Id. ¶ 35) (citing Standards for Privacy of Individually Identifiable Health Information – Final Rule, 65 Fed. Reg. 82462 (Dec. 28, 2000) ).

According to the complaint, "the Privacy Rule addressed how consumers could obtain their PHI and how much they could be charged for copies of it," (Compl. ¶ 37), and HITECH "clarified the procedures under which a consumer would obtain their PHI," including by "capp[ing] the fee that a provider could charge" for copies of PHI in electronic format. (Id. ¶ 39) (citing 45 C.F.R. § 164.524(c)(4) ). Plaintiffs allege that in 2013, HHS "published amendments to the Privacy Rule," and, in 2016, "issued a guidance document clarifying" "limits on what patients or their designated recipients may be charged for healthcare information," (id. ¶¶ 40, 42), including allowance to "charge the requester a flat fee of $6.50" to provide records. (Id. ¶ 43).

According to the complaint, defendant is "aware that the Privacy Rule as interpreted by HHS allows it to charge individuals only on the basis of its actual costs, or an average of its actual costs." (Id. ¶ 52). Plaintiffs allege that "[d]espite knowing that federal law allows it to charge individuals only on the basis of its actual costs, or an average of its actual costs," defendant "continually overcharges patients and their agents for their records." (Id. ¶ 53).

As detailed in the complaint, "[p]laintiffs properly requested [PHI] from their medical providers, and directed that the records be sent to their lawyers." (Id. ¶ 68). "The medical providers forwarded [p]laintiffs' requests" to defendant, but defendant allegedly "did not follow the HITECH Act and Privacy Rule in responding." ( Id. ). In particular, plaintiffs allege a similar pattern of activity related to each named plaintiff. For example:

Plaintiff S.C. is a minor and the son of Lakiesha Cross. In a written request dated May 15, 2018 and signed by his mother, Lakiesha Cross, Plaintiff S.C. requested copies of his medical records from Vidant Edgecombe Hospital in Tarboro, North Carolina. In his request, through his mother, S.C. requested copies of his medical records in electronic format only. S.C.'s request was headlined, "PATIENT DIRECTIVE TO HEALTHCARE PROVIDER PURSUANT TO HITECH RECORDS REQUEST." S.C. needed his medical records for a personal-injury matter. S.C. directed the recipient of this request to send the records to his attorney, Christopher C. Kessler ("Kessler"), The Kessler Law Firm P.L.L.C., P.O. Box 8064, Greenville, NC 27835. S.C.'s request was accompanied by documents from The Kessler Law Firm P.L.L.C. which asserted that the HITECH Act, 42 U.S.C. § 17935(e)(1), and the statute's implementing regulation at 45 C.F.R. § 164.524(c)(4), applied to the request. [Defendant] responded by sending a bill for $18 dated May 22, 2018 to The Kessler Law Firm. The billed total from [defendant] included a "Basic Fee" ($5.00); a "Retrieval Fee" ($5.00); eight pages billed at 75 cents each ($6.00); fourteen pages at no cost; and an "Electronic Data Archive Fee" ($2.00). In its response to S.C.'s request, Ciox did not state that these fees reflected its actual costs, or that these fees reflected an average of its actual costs. In its response, [defendant] did not reveal that these fees are unlawful under the HITECH act and Privacy Rule. On behalf of and as agent of S.C., S.C.'s attorney paid the expense. S.C.'s attorney was required to pay the expense in order to obtain the medical records for S.C.'s personal-injury matter.... The

...