Faber v. Ciox Health, LLC, No. 18-5896 (6th Cir. 2019)Annotate this Case
Three out of every five hospitals use Ciox, a medical records provider, which processed 4.3 million pages per day in 2018. Ciox is subject to the 1996 Health Insurance Portability and Accountability Act (HIPAA), 110 Stat. 1936. Department of Health and Human Service fee-limit provisions prohibit Ciox from charging patients more than “reasonable, cost-based fee[s]” for their records. Tennessee’s Medical Records Act (TMRA), prevents hospitals from charging patients more than the “reasonable costs for copying and the actual costs of mailing [their] records.” The named Plaintiffs worked with law firms to request their medical records from Tennessee hospitals. Ciox serviced those requests. Plaintiffs filed a class action, accusing Ciox of charging them more than what HIPAA regulations and TMRA allow. HIPAA does not authorize a private cause of action, so the Plaintiffs cited common-law causes of action: negligence, negligence per se, unjust enrichment, and breach of implied-in-law contract. The district court dismissed the TMRA claim but granted class certification and later granted Ciox summary judgment The Sixth Circuit affirmed. Tennessee's common law is no substitute for the private right of action that Congress refused to create in HIPAA. TMRA’s fee limits unambiguously do not apply to medical-records providers. Plaintiffs cannot prove the existence of any common-law duty or legal contract. Because the court did not send notice to absentee class members, the decision binds only the named Plaintiffs.