In a decision released May 4, 2017, the Wisconsin Supreme Court held that personal injury attorneys obtaining medical records on behalf of their clients are exempt from statutory certification and retrieval fees (Moya v. Healthport Technologies, LLC, 2017 WI 45, ¶ 2.).

The plaintiff was involved in a motor vehicle accident and retained counsel to represent her in that matter. She provided to her attorney a HIPAA-compliant authorization (“HIPAA Release”) for release of her medical records from her health care provider, and the record request was processed by Healthport Technologies, LLC (“Healthport”). The class action lawsuit before the Wisconsin Supreme Court focused on the certification and retrieval fees Healthport charged to her attorney in connection with accessing her records.

Access to patient health care records is governed by Wis. Stat. § 146.83 (the “Records Access Statute”). As applicable here, the Records Access Statute requires health care providers to provide copies of a patient’s health care records “if a person requests copies of [the records], provides informed consent, and pays the applicable fees under par. (b).” § 146.83(3f)(a). The fees include per-page costs for copying standard paper records and higher costs for duplicating microfiche and X-ray images. At issue in this case were the additional, one-time certification and retrieval fees, $8 and $20 respectively, which are chargeable under the statute only “if the requester is not the patient or a person authorized by the patient.” § 146.83(3f)(b).

The question before the court was whether a personal injury attorney who obtains his or her client’s health care records pursuant to a HIPAA Release is a “person authorized by the patient,” such that the attorney need not pay certification and retrieval fees when requesting copies of the records from a health care provider. As defined in the Records Access Statute, a “person authorized by the patient” includes, for example, parents, guardians and legal custodians of minors, along with the catch-all category of “any person authorized in writing by the patient.”

Writing for the Court, Justice Gableman reasoned that, based on the plain language of the statute, “any person authorized in writing by the patient” did in fact include an attorney authorized by his or her client to obtain records via a signed HIPAA Release, and, therefore, such attorneys are exempt from certification and retrieval fees under the Records Access Statute.

In so holding, the court rejected the defendants’ reading of the statute that, “[b]ecause each of the other categories of persons in the definition of ‘person authorized by the patient’ in [the Records Access Statute] has the authority to make health care decisions on behalf of the patient, the fifth category [–‘any person authorized in writing by the patient’–] must have that authority as well.” Moya, 2017 WI 45, ¶ 23. Finding instead that each category had varying authority parameters, the court agreed with the plaintiff that “any person authorized in writing by the patient” is a distinct category, limited not by the statute but by the scope of written authorization itself—here, the HIPAA Release.

In a dissenting opinion, Justice Ziegler agreed with the defendants’ argument and the Court of Appeals’ finding that a “person authorized by the patient” must not only have the power to receive those records—as an attorney armed with a HIPAA Release—but also have the power to consent to the release of the patient’s record, a requirement not satisfied by standard HIPAA Releases. This interpretation was based in part on the fact that another section of the Records Access Statute specifically adds State Public Defenders to the definition of a “person authorized by the patient.” This action by the legislature, Justice Ziegler reasoned, was one indication that attorneys generally do not meet the definition and are not meant to be exempt from the fees. Despite her interpretation of the statute, Justice Ziegler observed that “[a]s a practical matter, it certainly makes sense that the legislature might choose to exempt personal injury attorneys from the challenged fees. These attorneys act as advocates for their clients and perhaps should be able to obtain the records without the fee.” Id.¶ 42. But, she stated, such a policy adoption is for the legislature to enact and not for the judiciary to impose.

Practical Takeaways

The court was careful to limit its holding to attorneys seeking to access their own client’s medical records through use of a HIPAA Release and to certification and retrieval fees under the Records Access Statute. Based on the reasoning in the decision, “a person authorized by the patient” is easily read to include any other individual obtaining health care records via a HIPAA Release, but such was not the holding. It remains to be seen whether future litigation will extend the court’s interpretation to, for example, defense counsel who request plaintiffs’ records with HIPAA Releases and, consequently, if the Moya decision serves to eliminate the certification and retrieval fees altogether—a possibility suggested and criticized by Justice Ziegler in her dissent. On the other hand, the legislature may accept Justice Ziegler’s implicit invitation to intervene and nullify—or extend—the court’s interpretation of the statute. For now, though, the decision only exempts from these fee provisions “an attorney authorized by his or her client in writing via a HIPAA release form to obtain the client’s health care records.” Moya, 2017 WI 45, ¶ 38.

To be compliant with the new Moya rule, health care providers should not charge certification and retrieval fees when a request for records clearly indicates that an attorney is seeking medical records: (i) on behalf of his or her own client; (ii) who is the patient at issue; and (iii) the request is accompanied by a HIPAA Release. In all other circumstances, the status quo remains.