Case 1:18-cv-00040-APM Document 9 Filed 04/02/18 Page 1 of 2

UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF THE DISTRICT OF COLUMBIA
CIOX HEALTH, LLC,
Plaintiff,
v.
ALEX M. AZAR II, Secretary of Health
and Human Services, et al.,
Defendants.

)
)
)
)
)
)
)
)
)
)
)

Case No. 1:18-cv-00040 (APM)

DEFENDANTS’ MOTION TO DISMISS
In accordance with Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6), Defendants
Alex M. Azar II, Secretary of Health and Human Services, et al., respectfully move to dismiss
Plaintiff’s Complaint. In support of this Motion, Defendants respectfully refer the Court to the
attached Memorandum of Points and Authorities and Proposed Order.

 Case 1:18-cv-00040-APM Document 9 Filed 04/02/18 Page 2 of 2

Dated: April 2, 2018

Respectfully submitted,
CHAD A. READLER
Acting Assistant Attorney General
JESSIE K. LIU
United States Attorney
JOEL McELVAIN
Assistant Director
/s/ Vinita B. Andrapalliyal
Vinita B. Andrapalliyal
Trial Attorney
United States Department of Justice
Civil Division
Federal Programs Branch
P.O. Box 883
Washington, DC 20044
Tel: (202) 305-0845
vinita.b.andrapalliyal@usdoj.gov
Counsel for Defendants

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 1 of 34

TABLE OF CONTENTS

INTRODUCTION .......................................................................................................................... 3
BACKGROUND ............................................................................................................................ 4
A. Legal Background ................................................................................................................ 5
B. Factual Background and Procedural History ....................................................................... 9
LEGAL STANDARDS ................................................................................................................ 12
ANALYSIS ................................................................................................................................... 13
I. The Court lacks jurisdiction to hear Ciox’s claims. ............................................................. 13
a. Ciox lacks Article III standing to assert its claims. ................................................. 13
b. Ciox’s claims are unripe. ......................................................................................... 19
II. Ciox fails to state a claim upon which relief may be granted ............................................ 22
a. Ciox lacks statutory standing to bring its claims ..................................................... 22
b. Counts Two and Three challenge agency action that is not final under the APA ... 25
CONCLUSION ............................................................................................................................. 30

i

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 2 of 34

TABLE OF AUTHORITIES
CASES
AARP v. United States Equal Employment Opportunity Comm’n,
267 F. Supp. 3d 14 (D.D.C. 2017), on reconsideration, No. CV 16-2113 (JDB),
2017 WL 6542014 (D.D.C. 2017) ............................................................................................ 19
Abbott Labs v. Gardner,
387 U.S. 136 (1967) abrogated on other grounds by
Califano v. Sanders, 97 S. Ct. 980 (1977) ................................................................................ 17
Abhe & Svoboda, Inc. v. Chao,
508 F.3d 1052 (D.C. Cir. 2007) ................................................................................................ 11
Action Alliance of Senior Citizens of Greater Phila. v. Heckler,
789 F.2d 931 (D.C. Cir. 1986) .................................................................................................. 18
Advanced Mgmt. Tech., Inc. v. FAA,
211 F.3d 633 (D.C. Cir. 2000) .................................................................................................. 14
Am. Freedom Law Ctr. v. Obama,
106 F. Supp. 3d 104 (D.D.C. 2015), aff'd, 821 F.3d 44 (D.C. Cir. 2016) ................................ 12
Am. Nat’l Ins. Co. v. FDIC,
642 F.3d 1137 (D.C. Cir. 2011) ................................................................................................ 10
Am. Servicemen's Union v. Mitchell,
54 F.R.D. 14 (D.D.C. 1972)...................................................................................................... 19
Am. Tort Reform Ass’n v. Occupational Safety & Health Admin.,
738 F.3d 387 (D.C. Cir. 2013) .................................................................................................. 24
Appalachian Power Co. v. EPA,
208 F.3d 1015 (D.C. Cir. 2000) ................................................................................................ 27
Arpaio v. Obama,
797 F.3d 11 (D.C. Cir. 2015) .................................................................................................... 15
Ashcroft v. Iqbal,
556 U.S. 662 (2009) .................................................................................................................. 10
Ass'n of Am. Physicians & Surgeons, Inc. v. HHS,
224 F. Supp. 2d 1115 (S.D. Tex. 2002), aff'd, 67 F. App'x 253 (5th Cir. 2003) ........................ 4

ii

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 3 of 34

Ass’n of Am. R.Rs. v. Costle,
562 F.2d 1310 (D.C. Cir. 1977) ................................................................................................ 26
Ass'n of Data Processing Serv. Orgs., Inc. v. Camp,
397 U.S. 150 (1970) .................................................................................................................. 26
Ass’n of Flight Attendants-CWA, AFL-CIO v. Huerta,
785 F.3d 710 (D.C. Cir. 2015) ............................................................................................ 25, 26
Bank of Am. Corp. v. City of Miami, Fla.,
137 S. Ct. 1296 (2017) .............................................................................................................. 21
Bell Atl. Corp. v. Twombly,
550 U.S. 544 (2007) .................................................................................................................. 10
Bennett v. Spear,
520 U.S. 154 (1997) ............................................................................................................ 23, 25
Brock v. Pierce Cnty.,
476 U.S. 253 (1986) .................................................................................................................... 4
Browning v. Clinton,
292 F.3d 235 (D.C. Cir. 2002) .................................................................................................. 10
Chesapeake Climate Action Network v. Exp.-Import Bank of the United States,
78 F. Supp. 3d 208 (D.D.C. 2015) ............................................................................................ 17
Chlorine Inst., Inc. v. Fed. R.R. Admin.,
718 F.3d 922 (D.C. Cir. 2013) .................................................................................................. 17
Clean Air Implementation Project v. EPA,
150 F.3d 1200 (D.C. Cir. 1998) ................................................................................................ 18
CSI Aviation Servs., Inc. v. U.S. Dep't of Transp.,
637 F.3d 408 (D.C. Cir. 2011) .................................................................................................. 23
Ctr. for Auto Safety v. Nat’l Highway Traffic Safety Admin.,
452 F.3d 798 (D.C. Cir. 2006) .................................................................................................. 25
Ctr. For Sci. In The Pub. Interest v. Food & Drug Admin.,
CIV.A.03-1962 RBW, 2004 WL 2011467 (D.D.C. 2004) ....................................................... 24
Food & Water Watch, Inc. v. Vilsack,
808 F.3d 905 (D.C. Cir. 2015) .................................................................................................. 18

iii

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 4 of 34

Friends of The Earth, Bluewater Network Div. v. U.S. Dep't of Interior,
478 F. Supp. 2d 11 (D.D.C. 2007) ............................................................................................ 13
Friends of the Earth, Inc. v. Laidlaw Envtl. Servs., Inc.,
528 U.S. 167 (2000) .................................................................................................................. 13
Herbert v. Nat’l Acad. of Scis.,
974 F.2d 192 (D.C. Cir. 1992) .................................................................................................. 10
Indep. Equip. Dealers Ass’n v. EPA,
372 F.3d 420(D.C. Cir. 2004) ................................................................................................... 27
Indus. & Fin. Markets Ass'n v. United States Commodity Futures Trading Comm’n,
67 F. Supp. 3d 373 (D.D.C. 2014) ............................................................................................ 27
Kowalski v. Tesmer,
543 U.S. 125 (2004) .................................................................................................................. 17
Lexmark Int'l, Inc. v. Static Control Components, Inc.,
134 S. Ct. 1377 (2014) .............................................................................................................. 22
Lujan v. Defs. of Wildlife,
504 U.S. 555 (1992) ................................................................................................ 10, 11, 12, 15
Match-E-Be-Nash-She-Wish Band of Pottawatomi Indians v. Patchak,
132 S. Ct. 2199 (2012) .............................................................................................................. 20
Matthew A. Goldstein, PLLC v. United States Dep’t of State,
851 F.3d 1 (D.C. Cir. 2017) ...................................................................................................... 14
Molycorp, Inc. v. EPA,
197 F.3d 543 (D.C. Cir. 1999) .................................................................................................. 27
Mountain States Legal Foundation v. Glickman,
92 F.3d 1228 (D.C. Cir. 1996) .................................................................................................. 13
Nat'l Abortion Fed’n v. Ashcroft,
No. 03 CIV. 8695 (RCC), 2004 WL 555701 (S.D.N.Y. Mar. 19, 2004).................................. 19
Nat'l Ass'n of Home Builders v. Norton,
415 F.3d 8 (D.C. Cir 2005) ....................................................................................................... 26
Nat'l Min. Ass'n v. Jackson,
768 F. Supp. 2d 34 (D.D.C. 2011) ............................................................................................ 25

iv

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 5 of 34

Nat'l Min. Ass'n v. McCarthy,
758 F.3d 243 (D.C. Cir. 2014) ............................................................................................ 24, 27
Nat'l Multi Hous. Council v. Jackson,
539 F. Supp. 2d 425 (D.D.C. 2008) .......................................................................................... 17
Nat'l Park Hospitality Ass’n v. Dep't of Interior,
538 U.S. 803 (2003) ............................................................................................................ 20, 24
Nat'l Wildlife Fed. v. EPA,
286 F.3d 554 (D.C. Cir. 2002) .................................................................................................. 26
Nat'l Wrestling Coaches Ass'n v. Dep't of Educ.,
366 F.3d 930, 940 (D.C. Cir. 2004), abrogation on other grounds recognized by Perry
Capital, LLC v. Mnuchin, 864 F.3d 591(D.C. Cir. 2017) ............................................. 12, 15, 16
Ohio Forestry Ass'n v. Sierra Club,
523 U.S. 726 (1998) ............................................................................................................ 18, 20
Regions Hospital v. Shalala,
522 U.S. 448 (1998) .................................................................................................................... 4
Reliable Automatic Sprinkler Co. v. Consumer Prod. Safety Comm'n,
324 F.3d 726 (D.C. Cir. 2003) .................................................................................................. 23
Renal Physicians Ass'n v. HHS,
489 F.3d 1267 (D.C. Cir. 2007) ................................................................................................ 16
S.C. Med. Ass'n v. Thompson,
327 F.3d 346 (4th Cir. 2003) .................................................................................................. 3, 4
Sabre, Inc. v. U.S. Dep't of Transp.,
429 F.3d 1113 (D.C. Cir. 2005) ........................................................................................... 12-13
Sierra Club v. Envtl. Prot. Agency,
873 F.3d 946 (D.C. Cir. 2017) .................................................................................................. 24
Spokeo, Inc. v. Robins,
136 S. Ct. 1540 (2016) .............................................................................................................. 13
Sprint Corp. v. FCC,
331 F.3d 952 (D.C. Cir. 2003) ............................................................................................ 18, 19
State Farm Mut. Auto. Ins. Co. v. Dole,
802 F.2d 474 (D.C. Cir. 1986) .................................................................................................. 20

v

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 6 of 34

State Nat'l Bank of Big Spring v. Lew,
795 F.3d 48 (D.C. Cir. 2015) .............................................................................................. 11, 16
Toilet Goods Ass’n v. Gardner,
387 U.S. 158 (1967) ............................................................................................................ 18, 19
Valley Forge Christian Coll. v. Ams. United for Separation of Church and State,
454 U.S. 464 (1982) ...................................................................................................................... 22
STATUTES
5 U.S.C. § 551 ............................................................................................................................... 25
5 U.S.C. § 702 ............................................................................................................................... 20
5 U.S.C. § 704 ............................................................................................................................... 23
5 U.S.C. § 706 ............................................................................................................................. 8, 9
42 U.S.C. § 17931 ......................................................................................................................... 22
42 U.S.C. § 17935 .................................................................................................................. passim
42 U.S.C. § 17921 ....................................................................................................................... 5, 8
42 U.S.C § 264 ................................................................................................................................ 4
Pub. L. No. 104–191, 110 Stat 1936 (1936) .................................................................................. 3
RULES
Fed. R. Civ. P. 12(b)(6)........................................................................................................... 23, 28
REGULATIONS
45 C.F.R. § 160.103 .................................................................................................................... 4, 8
45 C.F.R. § 160.104 ........................................................................................................................ 4
45 C.F.R. § 160.304 ...................................................................................................................... 14
45 C.F.R. § 164.524 ............................................................................................................... passim
65 Fed. Reg. 82462-01 (Dec. 28, 2000) .......................................................................................... 4
78 Fed. Reg. 5566 (Jan. 25, 2013) .................................................................................................. 5

vi

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 7 of 34

INTRODUCTION
The Department of Health and Human Services (“HHS”) has issued a rule that addresses
an individual’s statutory right to access their protected health information (“PHI”), as well as the
corresponding obligation of “covered entities”—that is, certain healthcare providers, health
plans, and healthcare clearinghouses—to provide PHI to individuals at a reasonable cost.
Congress originally codified this right and obligation in the Health Information Portability and
Accountability Act of 1996 (HIPAA), which HHS implemented though what is known as the
“Privacy Rule.” In 2009, Congress expanded the application of certain of the Privacy Rule’s
provisions to “business associates” of covered entities, authorized HHS to regulate business
associates, and expanded the rights of individuals to access their PHI. HHS implemented these
statutory changes in 2013 by amending the Privacy Rule. In 2016, HHS issued guidance that
provided the public with information as to how the agency implemented the 2013 rule.
The plaintiff here, Ciox Health, LLC, alleges that HHS’s 2013 rule implementing
relevant statutory changes with respect to covered entities is ultra vires and arbitrary and
capricious. Ciox further alleges that HHS’s 2016 publicly-issued guidance, which provides
advice and answers to frequently asked questions about the rule, (1) was improperly issued
without adhering to notice and comment rulemaking procedures, (2) is ultra vires, and (3) is
arbitrary and capricious.
Ciox, however, is not a covered entity that is subject to the rule and guidance that it
challenges. Rather, as a specialized medical records provider that supplies health information
management services to healthcare providers, it is defined as a “business associate” under the
relevant health and privacy laws and is subject to its own separate obligations under those laws.
Although Ciox can, by agreement, discharge a covered entity’s obligation to provide an

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 8 of 34

individual’s PHI, the Privacy Rule does not govern the payments that Ciox receives from the
covered entity. Rather, Ciox and the covered entity are free to negotiate the terms of the
payments that Ciox may receive for its services.
For that reason, Ciox fails to meet its heightened burden to establish Article III standing
to raise its claims as a third party to the rule and guidance that it challenges; it fails to
demonstrate that it has suffered a concrete and particularized injury that is fairly traceable to the
2013 rule and 2016 guidance at issue and which would be redressed through the vacatur of the
rule and guidance that it seeks.
Ciox’s claims are similarly unripe. It brings a challenge to (1) a rule that is anchored in a
complex statutory scheme without basing the challenge on any concrete enforcement action, and
(2) guidance that is non-final agency action that has no force or effect of law, as discussed
below. There is not yet anything for Ciox to challenge here.
Further, Ciox lacks prudential, or statutory, standing because Ciox fails to demonstrate
that it falls within the “zone of interests” of the statute anchoring its claims. That statute, like the
Privacy Rule provision and the guidance, is solely concerned with imposing obligations upon
covered entities with respect to the manner of and fees relating to the provision of PHI at an
individual’s request, not with imposing such obligations upon business associates like Ciox.
Finally, the 2016 guidance that Ciox challenges is not final agency action, because the
guidance imposes no independent legal obligations of its own. Rather, it explains HHS’s current,
nonbinding view of the law—which HHS has the discretion to change or depart from—and
provides nonbinding suggestions for how to calculate reasonable costs that can be passed onto
the individual requesters. Thus, the 2016 guidance is not subject to review under the APA.
For these reasons, as explained further below, Ciox’s claims must be dismissed.

2

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 9 of 34

BACKGROUND
A. Legal Background
HHS’s actions in this case were governed by HIPAA, the Health Information Technology
for Economic and Clinical Health (“HITECH”) Act, and regulations promulgated in accordance
with these statutes. Congress enacted HIPAA in part to “improve portability and continuity of
health insurance coverage in the group and individual markets.” Health Insurance Portability and
Accountability Act, Pub. L. No. 104–191, 110 Stat. 1936 (1996). The Secretary of HHS is
primarily charged with enforcing HIPAA (and the subsequent legislation amending and adding
to its provisions). The Secretary may attempt to resolve complaints or reports indicating noncompliance through informal means, such as the provision of technical assistance, before
initiating a formal enforcement action. 45 C.F.R. § 164.524.
Section 264(c) of HIPAA required the Secretary of HHS to submit “detailed
recommendations on standards with respect to the privacy of individually identifiable [health]
information” within 12 months of HIPAA’s enactment. “If legislation governing standards with
respect to the privacy of individually identifiable health information transmitted . . . is not
enacted by the date that is 36 months after” HIPAA’s enactment, the statute directed that “the
Secretary of Health and Human Services shall promulgate final regulations containing such
standards not later than the date that is 42 months after the date of the enactment of this Act.” Id.
§ 264(c)(1); see also S.C. Med. Ass'n v. Thompson, 327 F.3d 346, 348 (4th Cir. 2003) (describing
the “two-step process to address the need to afford certain protections to the privacy of health
information maintained under HIPAA”). HHS’s regulations were to address at least: (1) “[t]he
rights that an individual who is a subject of individually identifiable health information should
have[;]” (2) “[t]he procedures that should be established for the exercise of such rights[;]” and

3

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 10 of 34

(3) “[t]he uses and disclosures of such information that should be authorized or required.” 42
U.S.C § 264(b); see also id. § 264(c)(1).
HHS promulgated the Privacy Rule, the regulation containing the standards requested by
Congress in 2001, after Congress failed to enact governing standards of its own.1 U.S. Dep’t of
Health and Human Servs., Standards for Privacy of Individually Identiifiable Health
Information, 65 Fed. Reg. 82,462-01 (Dec. 28, 2000); see also Thompson, 327 F.3d at 349. The
regulation included a procedure for future modifications. See 45 C.F.R. § 160.104.
The Privacy Rule also included 45 C.F.R. § 164.524, titled “Access of individuals to
protected health information,” which is the primary provision at issue in this case. 65 Fed. Reg.
82462-01. This provision set forth an individual’s right to access his or her PHI; narrow
instances in which a covered entity may deny access; requirements for the form, time, and
manner of PHI production; and the types of costs that can permissibly be charged to the
individual for the production. 45 C.F.R. § 164.524. It applies to covered entities, which are
defined as health plans, health care clearinghouses, and health providers that “transmits any
health information in electronic form in connection with a transaction covered by this
subchapter.” 45 C.F.R. § 160.103.
In 2009, Congress passed the HITECH Act, which encourages the use of electronic
health records (“EHRs”) and directs HHS to apply 45 C.F.R. § 164.524 such that “in the case
that a [healthcare provider] uses or maintains an [EHR] with respect to [PHI] of an individual . . .

1

Although the original regulations were enacted in 2001, more than 42 months from HIPAA’s
enactment, “HHS’s delay in promulgating the final Privacy Rule did not deprive the agency of
the power to act.” Ass'n of Am. Physicians & Surgeons, Inc. v. HHS, 224 F. Supp. 2d 1115, 1127
(S.D. Tex. 2002), aff'd, 67 F. App'x 253 (5th Cir. 2003) (noting that HHS’s delay, “particularly
in the face of huge administrative burdens, . . . do[es] not result in the invalidation of HHS's
authority to promulgate the Privacy Rule”) (citing Regions Hospital v. Shalala, 522 U.S. 448,
459 n.2 (1998); Brock v. Pierce Cnty., 476 U.S. 253, 260 (1986)).
4

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 11 of 34

the individual shall have a right to obtain from such [healthcare provider] a copy of such
information in an electronic format and, if the individual chooses, to direct the [provider] to
transmit such copy directly to an entity or person designated by the individual . . . .” 42 U.S.C.
§ 17935(e)(1). Further, “any fee that the covered entity may impose for providing . . . a copy . . .
if such copy . . . is in an electronic form shall not be greater than the entity’s labor costs in
responding to the request for the copy.” Id. § 17935(e)(3). Congress defined an EHR as “an
electronic record of health-related information on an individual that is created, gathered,
managed, and consulted by authorized health care clinicians and staff.” Id. § 17921.
In response, HHS modified the Privacy Rule along with other regulations. (“the 2013
Rule”). Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification
Rules under the [HITECH] Act and the Genetic Information Nondiscrimination Act; Other
Modifications to the HIPAA Rules, 78 Fed. Reg. 5566 (Jan. 25, 2013). Three modifications bear
on this case. First, the Privacy Rule now states that “[i]f an individual’s request for access directs
the covered entity to transmit the copy of protected health information directly to another person
designated by the individual, the covered entity must provide the copy to the person designated
by the individual.” 45 C.F.R. § 164.524(c)(3)(ii). Second, covered entities must now “provide the
individual with access to the [PHI] in the form and format requested by the individual, if it is
readily producible in such form or format; or, if not, in a readable hard copy form or such other
form or format as agreed to by the covered entity and the individual.” Id. § 164.524(c)(2)(i).
Finally, the Privacy Rule states that part of the “reasonable, cost-based fee” that a covered entity
may charge for complying with the individual’s request for his or her PHI includes the cost of
“[l]abor for copying the protected health information requested by the individual, whether in
paper or electronic form[,]” Id. § 164.524(c)(4)(i) (emphasis added). In the preamble to the final

5

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 12 of 34

rule, HHS “clarif[ied] that labor costs included in a reasonable cost-based fee could include
skilled technical staff time spend to create and copy the electronic file, such as compiling,
extracting, scanning and burning protected health information to media, and distributing the
media.” 78 Fed. Reg. 5636.
In 2016, HHS issued publicly available nonbinding guidance regarding 45 C.F.R. §
164.524. Guidance: Individuals’ Right under HIPAA to Access Their Health Information 45
C.F.R. § 164.524 (“Guidance”), ECF No. 1-1. The guidance, in large part, takes the form of
frequently asked questions (“FAQ”) and answers. The guidance includes three statements that
are at issue in this litigation.
First, the guidance notes in an answer to a FAQ that Section 164.524’s limitations on fees
that can be charged for individuals to access copies of their PHI apply “when an individual
directs a covered entity to send the PHI to the third party, . . . regardless of whether the
individual has requested that the copy of PHI be sent to herself, or has directed that the covered
entity send the copy directly to a third party designated by the individual (and it doesn’t matter
who the third party is).” Id. at 17–18 (citing 45 C.F.R. § 164.524(c)(3)(ii)). Although this
guidance is not binding on any covered entity, HHS continues to hold this view about the reach
of Section 164.524.
Second, the guidance provides HHS’s nonbinding view that the reasonable cost of “labor
for copying the PHI requested by the individual” should only include “labor for creating and
delivering the electronic or paper copy in the form and format requested or agreed upon by the
individual, once the PHI that is responsive to the request has been identified, retrieved or
collected, compiled and/or collated, and is ready to be copied.” Id. at 8, 11–13 (citing 45 C.F.R.
§ 164.524(c)(4)(i)). As the guidance makes clear, HHS does not interpret the regulation as

6

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 13 of 34

allowing covered entities to pass on the “costs associated with reviewing the request for access;
or searching for and retrieving the PHI, which includes locating and reviewing the PHI in the
medical or other record, and segregating or otherwise preparing the PHI that is responsive to the
request for copying.” Id at 11. As stated in the guidance, HHS reasons that “[w]hile it has always
been prohibited to pass on to an individual labor costs related to search and retrieval, [HHS’s]
experience in administering and enforcing the HIPAA Privacy Rule has shown there is confusion
about what constitutes a prohibited search and retrieval cost[,]” providing the impetus for the
clarification. Id. Although this guidance is not binding on any covered entity and is not
controlling authority, HHS continues to hold this view about the scope of the costs described in §
164.424(c)(4)(i).
Third, the guidance suggests three ways in which covered entities may calculate the
“reasonable, cost-based fee” they can charge for providing PHI to individuals in accordance with
45 C.F.R. § 164.524. Id. at 14–16. The following methods may be used: (1) calculating the actual
costs that can be recouped under the regulation; (2) calculating average costs, by using a
schedule of costs for labor; and (3) using a flat fee of $6.50 for electronic copies of PHI that are
also maintained electronically. Id at 16. The guidance does not require covered entities to use
one of these options; neither does it prohibit using alternative calculations to arrive at a
reasonable, cost-based fee as set forth in Section 164.524. Id.
B. Factual Background and Procedural History
Defendants assumes the allegations in the Complaint to be true for the purposes of this
motion to dismiss. Ciox is a specialized medical-records provider that retrieves and discloses

7

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 14 of 34

protected health information (“PHI”) for health care providers. Compl., ECF No. 1 ¶ 5. As such,
Ciox is a “business associate” under HIPAA.2 Id.
Ciox filed the instant lawsuit on January 8, 2018, alleging the following claims. First, the
2013 Rule and the 2016 Guidance’s “unbounded third-party directive” requiring covered entities
to provide an individual’s PHI subject to the rule’s other requirements regardless of whether the
PHI is contained in an EHR and in the format requested by the individual, as opposed to a purely
electronic format, is ultra vires and thus violates 5 U.S.C. § 706(2)(A) and (C). Compl. ¶ 60.
Second, the 2016 Guidance’s “binding” characterization of the allegedly new “rate-, price-,
service-, cost-, and accounting-related requirements” it sets forth, id. ¶ 68, as well as
enforcement action HHS has allegedly taken in connection with its guidance qualifies the rule as
legislative and was thus unlawfully issued ‘“without observance of the procedure required by

2

The HIPAA regulations specifically differentiate business associates from covered entities.
Business associates are generally defined as a person who:
(i) On behalf of such covered entity or of an organized health care arrangement . .
. in which the covered entity participates, but other than in the capacity of a member
of the workforce of such covered entity or arrangement, creates, receives,
maintains, or transmits protected health information for a function or activity
regulated by this subchapter, including claims processing or administration, data
analysis, processing or administration, utilization review, quality assurance, patient
safety activities . . . , billing, benefit management, practice management, and
repricing; or
(ii) Provides, other than in the capacity of a member of the workforce of such
covered entity, legal, actuarial, accounting, consulting, data aggregation . . . ,
management, administrative, accreditation, or financial services to or for such
covered entity, or to or for an organized health care arrangement in which the
covered entity participates, where the provision of the service involves the
disclosure of protected health information from such covered entity or arrangement,
or from another business associate of such covered entity or arrangement, to the
person.
45 C.F.R. § 160.103; see also 42 U.S.C. §§ 17921(2), (3).
8

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 15 of 34

law,”’ violating 5 U.S.C. § 706(2)(D). Id. ¶ 69 (citation omitted). Third, the 2016 Guidance
violates 5 U.S.C. § 706(2)(A) and (C) by (1) directing “healthcare providers and their affiliates to
begin applying [fee limitations] to Third Party Directives and . . .threaten[s] to take enforcement
action against companies who fail[] to follow this loss-generating mandate,” id. ¶ 74; (2) limiting
the fees that can be charged to exclude “technical staff time involved in the process of searching
for and retrieving” electronic PHI, id. ¶ 76; and (3) providing a “tripartite methodology for
calculating allowable costs under the Patient Rate[.]” Id. ¶ 77. The complaint seeks declaratory
judgment and injunctive relief.
Ciox attached a letter to the Complaint, dated March 2017. Davis Letter, ECF No. 1-2.
The letter was sent from Celeste H. Davis, a Regional Manager at HHS’s Office of Civil Rights,
to Jared Sommers, Privacy Coordinator Officer at CHI St. Francis, which the letter identifies as a
covered entity. The letter states that HHS received a complaint regarding an individual’s request
to CHI St. Francis for her PHI to be sent to a law firm, and states that Ciox sent an invoice to her
in the amount of $224.65 for the service. Id. at 1. In the letter, HHS stated that in accordance
“with its authority under 45 C.F.R. §§ 160.304(a) and (b),” its Office of Civil Rights (“OCR”)
“has determined to resolve this matter informally through the provision of technical assistance . .
. . .” Id at 5. The letter further stated that “[s]hould OCR receive a similar allegation of
noncompliance against [CHI St. Francis] in the future, OCR may initiate a formal investigation
of that matter.” Id. According to Ciox, this letter is evidence that HHS is taking enforcement
action against itself and other companies over perceived violations to the 2016 guidance. Compl.
¶¶ 58, 67. Ciox alleges that the letter “inform[ed] Ciox that it had violated [the 2016 guidance]
by invoicing certain allegedly excluded fees in response to a regulatory third party directive.” Id.
¶ 58.

9

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 16 of 34

LEGAL STANDARDS
To survive a motion to dismiss under Rule 12(b)(1), a plaintiff must establish the
Court’s jurisdiction through sufficient allegations. See Lujan v. Defs. of Wildlife, 504 U.S. 555,
561 (1992). When considering such a motion, the Court must accept all well-pleaded
allegations as true. See Am. Nat’l Ins. Co. v. FDIC, 642 F.3d 1137, 1139 (D.C. Cir. 2011). The
Court need not, however, accept inferences that are unsupported by facts alleged in the
complaint or that amount to mere legal conclusions. See Browning v. Clinton, 292 F.3d 235,
242 (D.C. Cir. 2002). In evaluating subject-matter jurisdiction, the court may, when necessary,
look beyond the complaint to “undisputed facts evidenced in the record, or the complaint
supplemented by undisputed facts plus the court’s resolution of disputed facts.” Herbert v.
Nat’l Acad. of Scis., 974 F.2d 192, 197 (D.C. Cir. 1992).
To survive a motion to dismiss under Rule 12(b)(6), a plaintiff’s complaint must
contain “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v.
Twombly, 550 U.S. 544, 570 (2007). This “plausibility” standard “asks for more than a sheer
possibility that a defendant has acted unlawfully.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009).
“Where a complaint pleads facts that are ‘merely consistent with’ a defendant’s liability, it
‘stops short of the line between possibility and plausibility of ‘entitlement to relief.’” Id.
(quoting Twombly, 550 U.S. at 557). While the Court accepts well-pleaded factual allegations
as true, “mere conclusory statements” and “legal conclusion[s] couched as . . . factual
allegation[s]” are “disentitle[d] . . . to th[is] presumption of truth.” Id. at 678, 681 (citation
omitted). Although the Court generally may not rely on material outside the pleadings under
Rule 12(b)(6), it may consider materials incorporated into the complaint by reference, as well
as judicially noticeable materials, without converting the motion into one for summary

10

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 17 of 34

judgment. Abhe & Svoboda, Inc. v. Chao, 508 F.3d 1052, 1059 (D.C. Cir. 2007).
ANALYSIS
Ciox’s claims should be dismissed in full. The Court lacks jurisdiction to hear Ciox’s
claims because Ciox lacks Article III or third-party standing to challenge the rule and guidance
and because Ciox’s claims are unripe. Even if the Court had jurisdiction, Ciox fails to state a
claim upon which relief may be granted. Ciox fails to establish statutory standing because its
interests are outside the zone of interests of the substantive statute it seeks to protect under the
APA. Further, in Counts Two and Three, Ciox does not challenge final agency action, which is
required to seek APA review.
I. The Court lacks jurisdiction to hear Ciox’s claims.
a.

Ciox lacks Article III standing to assert its claims.

Because Ciox fails to show that it suffered an (1) injury-in-fact that is (2) fairly traceable
to the complained-of conduct and (3) likely to be redressed by a favorable decision by this Court,
it lacks constitutional standing to assert its claims. Lujan, 504 U.S. at 560. As an initial matter,
the relevant portion of the 2013 rule, which is also the basis for the 2016 guidance, imposes no
requirements or restrictions on business associates like Ciox. See supra n.2. Rather, both the
challenged provision of the Privacy Rule and the guidance apply only to covered entities, a
separate category of businesses. See 45 C.F.R. § 164.524(c)(3) (discussing the obligations of
covered entities to “provide the access as requested by the individual” without mention of
business associates); § 164.524(c)(4) (stating that “the covered entity may impose a reasonable,
cost-based fee” for fulfilling an individual’s request for a copy of his or her PHI, again without
mention of business associates). When “a plaintiff's asserted injury arises from the government's
allegedly unlawful regulation (or lack of regulation) of someone else, much more is needed.”
State Nat'l Bank of Big Spring v. Lew, 795 F.3d 48, 55 (D.C. Cir. 2015) (quoting Lujan, 504 U.S.
11

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 18 of 34

at 562). “In that circumstance, causation and redressability ordinarily hinge on the response of
the regulated (or regulable) third party to the government action or inaction.” Am. Freedom Law
Ctr. v. Obama, 106 F. Supp. 3d 104, 109 (D.D.C. 2015), aff'd, 821 F.3d 44 (D.C. Cir. 2016)
(quoting Lujan, 504 U.S. at 562). Specifically, “[t]he existence of one or more of the essential
elements of standing ‘depends on the unfettered choices made by independent actors not before
the courts and whose exercise of broad and legitimate discretion the courts cannot presume either
to control or to predict.”’ Id., 106 F. Supp. 3d at 109 (quoting Lujan, 504 U.S. at 562).
Here, Ciox’s injury depends on the conduct of health care providers, the covered entities
with whom it contracts to fulfill individual requests for PHI. “[C]ourts occasionally find the
elements of standing to be satisfied in cases challenging government action on the basis of thirdparty conduct. These cases fall into two . . . categories.” Nat'l Wrestling Coaches Ass'n
(“NWCA”) v. Dep't of Educ., 366 F.3d 930, 940 (D.C. Cir. 2004) abrogation on other grounds
recognized by Perry Capital, LLC v. Mnuchin, 864 F.3d 591(D.C. Cir. 2017). “First, a federal
court may find that a party has standing to challenge government action that permits or
authorizes third-party conduct that would otherwise be illegal in the absence of the Government's
action.” Id. “Second, some cases have held that plaintiffs have standing to challenge government
action on the basis of injuries caused by regulated third parties where the record presented
substantial evidence of a causal relationship between the government policy and the third-party
conduct, leaving little doubt as to causation and the likelihood of redress.” Id. at 941.
Ciox fails to demonstrate any of the elements of standing, let alone at the heightened
standard that applies to third parties.
Injury-in-fact: First, Ciox fails to show that it is has “suffered an ‘injury in fact’ that is (a)
concrete and particularized and (b) actual or imminent.” Sabre, Inc. v. U.S. Dep't of Transp., 429

12

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 19 of 34

F.3d 1113, 1117 (D.C. Cir. 2005) (quoting Friends of the Earth, Inc. v. Laidlaw Envtl. Servs.,
Inc., 528 U.S. 167, 180–81 (2000)); see also Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1548
(2016), as revised (May 24, 2016) (explaining the difference between “concrete” and
“particularized” injuries and reiterating the necessity of a claimant’s asserted injury meeting both
definitions to satisfy the “injury in fact” requirement for standing).
Ciox does not explicitly identify the harm it has incurred or will incur as a result of
HHS’s complained-of actions. Rather, the passing allegations relating to harm that are scattered
through the Complaint are alternately generalized, oblique and unsubstantiated. First, Ciox
alleges that HHS’s actions “threaten to . . . challenge the long-term viability of the medicalrecords industry” and “disrupt the American healthcare system.” Compl. ¶ 4. This allegation is of
“generalized or undifferentiated” sort that cannot support a showing of particularized injury.
Food & Water Watch, Inc. v. Vilsack, 808 F.3d 905, 914 (D.C. Cir. 2015) (citation omitted).
Next, Ciox states that “the overwhelming majority of Ciox’s revenues historically have come
from fulfilling patient-authorized requests for PHI from commercial third parties,” Compl. ¶ 22,
but it fails to allege a concrete and particularized, and actual or imminent, harm to those
revenues. Cf. Friends of The Earth, Bluewater Network Div. v. U.S. Dep't of Interior, 478 F.
Supp. 2d 11, 22 (D.D.C. 2007) (“‘In the absence of reference to past (and anticipated future)’
injury tied to a specific place, ‘a expression of enjoyment of all things sylvan is inadequate to
show a directly affected interest.’”) (quoting Mountain States Legal Foundation v. Glickman, 92
F.3d 1228, 1236–37 (D.C. Cir. 1996)). Finally, Ciox alleges that the 2016 guidance “threatens to
impose hundreds of millions of dollars in costs that can be no longer recouped by healthcare
providers . . .” Compl. ¶ 53, an allegation that is unanchored in any provided facts and unlinked

13

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 20 of 34

to Ciox’s position as a specialized medical records provider. See Advanced Mgmt. Tech., Inc. v.
FAA, 211 F.3d 633, 637 (D.C. Cir. 2000).
Ciox’s attempt to inject an enforcement challenge into its Complaint fails to allege an
injury-in-fact, as well. Ciox alleges that HHS threatened to “take enforcement action where
necessary” to enforce the 2016 guidance and “made good on that threat by informing Ciox that it
violated the 2016 [guidance] by invoicing certain allegedly excluded fees in response to a
regulatory third party directive.” Compl. ¶ 58. Ciox attaches a letter that HHS sent to CHI Health
St. Francis (CHI St. Francis), which HHS identifies as a covered entity. See Davis Letter. In that
letter, HHS notifies CHI St. Francis that it received a complaint from an individual alleging that
CHI St. Francis violated certain regulations when that individual requested her health records
from CHI St. Francis and thereafter received an invoice from Ciox charging $224.65 for
fulfilling the request. See id. at 1. The letter, however, is not directed at Ciox. Nor does it purport
to take any enforcement action against Ciox—or against CHI St. Francis, for that matter. See
generally id. Rather, it resolved the matter by offering technical assistance to CHI-St. Francis
and closed the case. Id. at 5; see also 45 C.F.R. § 160.304(b). Therefore, the letter that HHS sent
to CHI-St. Francis does not establish an actual or imminent concrete injury that Ciox suffered
such that would provide standing for Ciox here.
Indeed, because HHS has not and cannot take enforcement action against Ciox regarding
the fees it charges for individual requests of PHI, Ciox cannot raise either an enforcement or preenforcement challenge to the Privacy Rule provision and guidance at issue. See Matthew A.
Goldstein, PLLC v. United States Dep’t of State, 851 F.3d 1, 4 (D.C. Cir. 2017) (“It is true that a
plaintiff is not required to expose himself to liability before bringing suit to challenge the basis
for an enforcement action by the government. But there is something fundamental to a pre-

14

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 21 of 34

enforcement challenge that is missing here. There must be some desired conduct by the plaintiff
that might trigger an enforcement action in the first place.”) (citation omitted).
Causation: Nor does Ciox show that HHS’s complained-of actions caused any injury-infact. “The ‘causal connection between the injury and the conduct complained of’ must be ‘fairly
traceable to the challenged action of the defendant, and not the result of the independent action
of some third party not before the court.’” Arpaio v. Obama, 797 F.3d 11, 19 (D.C. Cir. 2015)
(quoting Lujan, 504 U.S. at 561). Here, the third parties not before the Court are the covered
entities with which Ciox contracts, such as CHI St. Francis. Therefore, Ciox must show that
there is “little doubt” as to the “causal relationship between the government policy [under
review] and the third-party conduct [that directly caused his injury][.]” NWCA, 366 F.3d at 941.
The “substantial factor” standard may be satisfied where there is “nothing . . . indicating that the
third parties whose conduct injured the plaintiffs would have had reason to continue their
injurious conduct unaltered in the absence of the challenged government action.” Id. at 943.
Here, the agreements that Ciox has negotiated with the covered entities with which it
does business control the payments that Ciox receives for its services. The Complaint is bereft of
any allegations specifically linking HHS’s complained-of conduct with the actions of covered
entities and the effects of those actions on Ciox. See generally Compl. Nor does HHS’s letter to
CHI-St. Francis demonstrate any causal relationship between the Privacy Rule provision and
guidance at issue and Ciox’s asserted injuries (to the extent they are properly asserted). Although
HHS notes in its letter that “all of the access requirements that apply with respect to PHI held by
the covered entity (e.g., an individual may be charged only a reasonable, cost-based fee that
complies to 45 C.F.R. § 164.524(c)(4)) apply with respect to PHI held by the business associate,”
that fact does not foreclose Ciox from receiving higher payments from the covered entity. Davis

15

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 22 of 34

Letter at 3. Ciox confuses the limited fee that an individual may be charged with the
compensation it can receive from the covered entity for its services. Ciox remains free to
negotiate its compensation with covered entities seeking to outsource the fulfillment of requests
for PHI to a business associate. Therefore, Ciox fails to allege in the Complaint how the 2013
Rule and the 2016 guidance are substantially likely to harm Ciox. NWCA, 366 F.3d at 944
(“Abstract theory and conjecture are not enough to support standing . . . .”); see State Nat'l Bank
of Big Spring v. Lew, 795 F.3d 48, 55 (D.C. Cir. 2015) (finding that the plaintiff, a bank, lacked
standing to challenge the Financial Stability Oversight Council’s “too big to fail” designation
authority because the plaintiff did not allege that it was subject to that authority and because its
theory of causality was “simply too attenuated and speculative to show the causation necessary
to support standing”).
Redressability: Finally, Ciox fails to establish that to the extent it has demonstrated an
injury, the injury could be redressed by a favorable decision from the Court. For Ciox to
successfully allege redressability, the facts alleged must “be sufficient to demonstrate a
substantial likelihood that the third party directly injuring the plaintiff would cease doing so as a
result of the relief the plaintiff sought.” Renal Physicians Ass'n v. United States HHS, 489 F.3d
1267, 1275 (D.C. Cir. 2007). Here, Ciox nowhere alleges that elimination of the relevant
portions of the 2013 Rule and the 2016 guidance would be substantially likely to cause the
covered entities with which they contract to refrain from inflicting whatever injury they claim.
While Ciox generally alleges that “the overwhelming majority of Ciox’s revenues historically
have come from fulfilling patient-authorized requests for PHI from commercial third parties . . . .
derived largely from fulfilling patient-authorized requests from for-profit insurance
conglomerates, incorporated businesses, and other commercial partnerships,” Compl. ¶ 22, it

16

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 23 of 34

does not connect this statement to an allegation demonstrating how the “nonagency activity”
that affects them—i.e., the activity of the covered entities—“will be altered or affected by the
agency activity they seek to overturn.” Chesapeake Climate Action Network v. Exp.-Import Bank
of the United States, 78 F. Supp. 3d 208, 225 (D.D.C. 2015) (citation omitted). In the absence of
that connection, Ciox does not demonstrate redressability.3
For these reasons, Ciox’s Complaint should be dismissed for want of Article III
standing.4
b.

Ciox’s claims are unripe.

Even if Ciox had standing, this court should not exercise jurisdiction over its claims
because they are unripe. See Chlorine Inst., Inc. v. Fed. R.R. Admin., 718 F.3d 922, 927 (D.C.
Cir. 2013). The ripeness requirement exists “to prevent the courts, through avoidance of
premature adjudication, from entangling themselves in abstract disagreements over
administrative policies, and also to protect the agencies from judicial interference until an
administrative decision has been formalized and its effects felt in a concrete way by the
challenging parties.” Abbott Labs v. Gardner, 387 U.S. 136, 148–49 (1967), abrogated on other

3

And as to Ciox’s challenges to the guidance in Counts Two and Three, Ciox fails to establish
how HHS’s rescission of the guidance would redress any properly-pleaded injury. As explained
in more detail infra, the guidance does not work a change in the law; rather, the guidance merely
explains HHS’s understanding of the rule and provides options for how covered entities can
calculate their costs in accordance with the rule. Therefore, HHS’s rescission of the guidance
would not alter the legal regime for Ciox. E.g., Nat'l Multi Hous. Council v. Jackson, 539 F.
Supp. 2d 425, 431-32 (D.D.C. 2008) (concluding that because the challenged-guidance “by its
own terms does not create any new obligations . . . . the relief plaintiffs seek would not redress
their claimed injury”).
4

Further, even if Ciox met the “constitutional minimum of standing” flowing from Article III’s
case-and-controversy requirement, it appears that Ciox is attempting to assert claims on behalf,
not of itself, but of the covered entities with which it contracts. However, Ciox fails to allege that
those entities are unable to protect their own rights. See generally Compl; see also Kowalski v.
Tesmer, 543 U.S. 125, 129–30 (2004). Thus, Ciox does not meet the criteria to bring its claims as
a third party.
17

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 24 of 34

grounds by Califano v. Sanders, 97 S. Ct. 980 (1977). In applying the ripeness doctrine, courts
consider two factors: “the fitness of the issues for judicial decision” and “the hardship to the
parties of withholding court consideration.” Id. at 149; accord Ohio Forestry Ass'n v. Sierra
Club, 523 U.S. 726, 733 (1998).
Ciox’s claims fail to meet either prong. First, Ciox’s claims are unfit for adjudication.
Under the fitness prong of the ripeness test, courts consider “whether the agency action is final;
whether the issue presented for decision is one of law which requires no additional factual
development; and whether further administrative action is needed to clarify the agency's
position[.]” Action Alliance of Senior Citizens of Greater Phila. v. Heckler, 789 F.2d 931, 940
(D.C. Cir. 1986). The existence of “final agency action” is “‘a crucial prerequisit[e]’ to
ripeness[.]” Sprint Corp. v. FCC, 331 F.3d 952, 956 (D.C. Cir. 2003) (citation omitted). But even
where there is final agency action and the challenge raises issues of law, the dispute “still may
not be fit for review where the agency retains considerable discretion to apply the new rule on a
case-by-case basis, particularly where there is a complex statutory scheme [.]” Id. In such cases,
judicial review “is likely to stand on a much surer footing in the context of a specific
application” of the agency's policy than it would “in the framework of [a] generalized
challenge.” Toilet Goods Ass’n v. Gardner, 387 U.S. 158, 164 (1967).
Here, as will be explained below, the guidance that Ciox challenges is not final agency
action, and HHS retains the discretion to modify or rescind the guidance. Ciox does also
challenge the 2013 Rule in Count One, which is a final agency action. But neither the challenge
to the rule nor the challenge to the guidance is fit for review because Ciox’s challenge would
benefit from a more concrete setting. See Clean Air Implementation Project v. EPA, 150 F.3d
1200, 1204 (D.C. Cir. 1998). Ciox has provided no substantiated allegations alleging that HHS

18

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 25 of 34

could or would exercise its discretionary enforcement authority against business associates like
Ciox; thus, the impact of the rule on Ciox is, at best, purely speculative at this point. See Am.
Servicemen's Union v. Mitchell, 54 F.R.D. 14, 17 (D.D.C. 1972) (courts “should not consider . . .
claims that are abstract, speculative and of no pressing immediacy”); see also Ctr. For Sci. In
The Pub. Interest v. Food & Drug Admin.,CIV.A.03-1962 RBW, 2004 WL 2011467, at *4
(D.D.C. 2004) (concluding that “since there is only an alleged procedural violation and because
the effects” of the action at issue “have not yet been felt by the plaintiffs, this case is not ripe for
review”). Further, there is a complex statutory scheme under HIPAA and the HITECH Act, the
laws that govern a covered entity’s statutory duties to provide an individual’s PHI, and further
complexities are raised where a business associate such as Ciox seeks to litigate the extent of a
covered entity’s duties. See, e.g., Nat'l Abortion Fed’n v. Ashcroft, No. 03 CIV. 8695 (RCC),
2004 WL 555701, at *2 (S.D.N.Y. Mar. 19, 2004) (analyzing the same part of the HIPAA
providing the basis for HHS’s regulations and noting that the legislation is “complex”); cf. AARP
v. United States Equal Employment Opportunity Comm’n, 267 F. Supp. 3d 14, 19 (D.D.C. 2017),
on reconsideration, No. CV 16-2113 (JDB), 2017 WL 6542014 (D.D.C. Dec. 20, 2017) (noting
the “complex regulatory and statutory framework” created in part by the HIPAA as amended by
a subsequent statute). Those complexities warrant “the context of a specific application” of the
agency’s policy to be ripe for adjudication here. Toilet Goods Ass’n, 387 U.S. at 164; see also
Sprint Corp., 331 F.3d at 956. Ciox fails to allege such a specific application of HHS policy.
Second, Ciox does not demonstrate that the Court’s immediate intervention is necessary
to prevent hardship. Under the hardship prong, courts consider the detriment to the parties from
deferring judicial review. Where the court or the agency has an institutional interest in deferral,
that interest will only be outweighed if deferral would “impose a hardship on the complaining

19

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 26 of 34

party that is immediate, direct, and significant.” State Farm Mut. Auto. Ins. Co. v. Dole, 802 F.2d
474, 480 (D.C. Cir. 1986). Such hardship must consist of “‘adverse effects of a strictly legal
kind[.]”’ Nat'l Park Hospitality Ass’n v. Dep't of Interior, 538 U.S. 803, 809 (2003) (quoting
Ohio Forestry Ass’n, 523 U.S. at 733). Sufficient hardship is not present when a party faces
“mere uncertainty as to the validity of a legal rule[.]” Id at 811.
As explained supra, Ciox has not even identified its injury-in-fact with sufficient
concreteness and particularity, and it is thus difficult to discern from the Complaint what, if any,
hardship Ciox faces in deferring review unless and until HHS takes enforcement action. In the
absence of such information, Ciox’s claims do not meet the hardship prong of the ripeness
analysis.
For these reasons, Ciox’s claims should be dismissed for lack of jurisdiction as unripe.
II. Ciox fails to state a claim upon which relief may be granted.
a.

Ciox lacks statutory standing to bring its claims.

Even if Ciox met the jurisdictional standing and ripeness requirements, Ciox lacks
prudential, or statutory, standing to bring this lawsuit. That is because Ciox’s interests do not fall
within the scope of the HITECH Act provision in which it seeks to anchor its claims. When a
plaintiff brings a claim under the APA as a party allegedly “aggrieved” by some agency action
that violated a substantive statute, see 5 U.S.C. § 702, that suit may not proceed unless the
interest asserted by the plaintiff is “arguably within the zone of interests to be protected or
regulated by the statute that he says was violated.” Match-E-Be-Nash-She-Wish Band of
Pottawatomi Indians v. Patchak, 132 S. Ct. 2199, 2210 (2012) (quoting Ass'n of Data Processing

20

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 27 of 34

Serv. Orgs., Inc. v. Camp, 397 U.S. 150, 153 (1970)).5 Although the prudential-standing test “is
not meant to be especially demanding,” a plaintiff lacks prudential standing if his “interests are
so marginally related to or inconsistent with the purposes implicit in the statute that it cannot
reasonably be assumed that Congress intended to permit the suit.” Id. at 2210(citation omitted).
Ciox claims that HHS’s actions violate 42 U.S.C. § 17935(e). See Compl. ¶¶ 62, 72. But
Ciox’s interests do not fall within the zone of interests to be protected or regulated by that
statutory provision. Section 17935(e) is titled “Access to certain information in electronic
format,” and sets forth an individual’s right to obtain PHI in an EHR. 42 U.S.C. § 17935. This
subsection has three components, none of which impose any requirements upon business
associates.
The first component, § 17935(e)(1), provides individuals with a right to obtain from
covered entities that maintain an individual’s PHI in an EHR “a copy of such information in an
electronic format and, if the individual chooses, to direct the covered entity to transmit such copy
directly to an entity or person designated by the individual . . . .” 42 U.S.C. § 17935(e)(1). It
makes no mention of business associates. The second component, § 17935(e)(2), and the only
one that mentions business associates, merely states that “if the individual makes a request to a
business associate for access to, or a copy of, [PHI] about the individual” or requests a business
associate to “grant such access to, or transmit such copy directly to, a person or entity designated
by the individual,” the business associate “may provide the individual with such access or copy

5

The Supreme Court has clarified that, although this test has been called “prudential standing,”
that phrase is a “misnomer;” rather, “[w]hether a plaintiff comes within the zone of interests is an
issue that requires us to determine, using traditional tools of statutory interpretation, whether a
legislatively conferred cause of action encompasses a particular plaintiff's claim.” Lexmark Int'l,
Inc. v. Static Control Components, Inc., 134 S. Ct. 1377, 1387 (2014) (citation omitted); see also
Bank of Am. Corp. v. City of Miami, Fla., 137 S. Ct. 1296, 1302 (2017) (“The question is
whether the statute grants the plaintiff the cause of action that he asserts.”).
21

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 28 of 34

. . . or grant or transmit such access or copy to such person or entity designated by the
individual.” Id. § 17935(e)(2) (emphasis added). The copy “may be an electronic form . . . .” Id.
(emphasis added). The third component, § 17935(e)(3), creates limitations on what covered
entities may charge for providing an individual’s PHI in an EHR; it states that “any fee that the
covered entity may impose for providing such individual with a copy of such information . . . if
such copy . . . is in an electronic form shall not be greater than the entity’s labor costs in
responding to the request for the copy . . . .” Id. § 17935(e)(3). Again, this component does not
impose a fee limitation on what business associates can charge—for example, it imposes no
limitations on what business associates can charge covered entities for their services.
Because the statute only imposes requirements on covered entities, while using purely
permissive language with respect to business associates options for providing PHI to individuals,
id. § 17935(e)(2), without including business associates in its fees limitation component, this
provision does not encompass business associates in its zone of interests such that would sustain
Ciox’s lawsuit challenging the provision’s requirements for covered entities. Prudential standing
can be satisfied only by a plaintiff's “own legal rights and interests,” not “the legal rights or
interests of third parties.” See Valley Forge Christian Coll. v. Ams. United for Separation of
Church and State, 454 U.S. 464, 474 (1982).
This conclusion is further borne out by the structure of the statute at issue and its
neighboring provisions. 42 U.S.C. § 17935 is preceded by two sections that specifically delineate
which relevant laws must be extended to business associates, and the fee and format
requirements in 42 U.S.C. § 17935(e) and 45 C.F.R. § 164.524 are not among those listed. See
42 U.S.C. § 17931 (stating that sections “164.308, 164.310, 164.312, and 164.316 of title 45,
Code of Federal Regulations, shall apply to a business associate of a covered entity in the same

22

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 29 of 34

manner that such sections apply to the covered entity”); id. § 17934 (applying two sets of
regulations and one set of statutes to business associates, none of which include 42 U.S.C.
§ 17935(e) or 45 C.F.R. § 164.524). Thus, Ciox is not liable for failure to comply with the
provision at issue.
For these reasons, Ciox’s asserted interests do not fall within 42 U.S.C. § 17935’s zone of
interests and, thus, the Complaint must also be dismissed on lack of prudential or statutory
standing.
b.

Counts Two and Three challenge agency action that is not final under the APA.

In Counts Two and Three, Ciox challenges HHS’s 2016 guidance, alleging that the
guidance violates the APA because it (1) was improperly crafted without notice and comment,
and (2) is both ultra vires and arbitrary and capricious. The 2016 guidance, however, is not final
agency action, and, thus, is not subject to judicial review under the APA. Therefore, these claims
should be dismissed for failure to state a claim. Fed. R. Civ. P. 12(b)(6); see also Reliable
Automatic Sprinkler Co. v. Consumer Prod. Safety Comm'n, 324 F.3d 726, 731 (D.C. Cir. 2003).
Judicial review under the APA is limited to “[a]gency action made reviewable by statute
and final agency action for which there is no other adequate remedy in a court[.]” 5 U.S.C. §
704. The Supreme Court defines final agency action as action (1) that marks the “consummation
of the agency’s decisionmaking process” and (2) by which “rights or obligations have been
determined, or from which “legal consequences will flow.” Bennett v. Spear, 520 U.S. 154, 177–
78 (1997) (citation omitted). The D.C. Circuit has provided “complementary” factors to assess
along with the test in Bennett. CSI Aviation Servs., Inc. v. U.S. Dep't of Transp., 637 F.3d 408,
412 (D.C. Cir. 2011) (examining whether the “agency had taken a definitive legal position
concerning its statutory authority[,]” whether “the case presented a purely legal question of

23

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 30 of 34

statutory interpretation[,]” and whether “the agency's letter imposed an immediate and significant
practical burden” on the agency)(citation omitted).
As a general matter, this Circuit has stated that general statements of policy are
categorically non-final agency action and, thus, precluded from judicial review. Nat'l Min. Ass'n
v. McCarthy, 758 F.3d 243, 251 (D.C. Cir. 2014) (citing Nat’l Park Hospitality Ass’n v. Dep’t of
the Interior, 538 U.S. 803, 809–11 (2003)). “An agency action that merely explains how the
agency will enforce a statute or regulation—in other words, how it will exercise its broad
enforcement discretion or permitting discretion under some extant statute or rule—is a general
statement of policy.” Id. at 252. Further, “interpretative rule[s] . . . generally do not qualify” as
final agency action “because they are not finally determinative of the issues or rights to which
they are addressed.” Am. Tort Reform Ass’n v. Occupational Safety & Health Admin., 738 F.3d
387, 395 (D.C. Cir. 2013) (citation omitted); see also Sierra Club v. Envtl. Prot. Agency, 873
F.3d 946, 951 (D.C. Cir. 2017). An interpretive rule “merely interprets a prior statute or
regulation, and does not itself purport to impose new obligations or prohibitions or requirements
on regulated parties.” Nat’l Min. Ass'n, 758 F.3d at 252. To distinguish between these types of
agency actions and a legislative rule, which would be subject to judicial review, this Circuit has
analyzed the following factors: (1) “the actual legal effect (or lack thereof) of the agency action
in question on regulated entities”; (2) “the agency’s characterization of the guidance”; and (3)
“whether the agency has applied the guidance as if it were binding on regulated parties. Id. at
252–53; Sierra Club, 873 F.3d at 951.

24

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 31 of 34

This court should not treat HHS’s guidance as the “consummation” of its decisionmaking
or as imposing rights, obligations, or legal consequences; it is not final agency action.6 See
Bennett, 520 U.S. at 177–78. Ciox has challenged three aspects of the guidance, but none of the
agency statements that it disputes is final agency action. The first challenged portion of the
guidance paraphrases or, at most, clarifies HHS’s position regarding the effect of the 2013 rule
by noting that the rule’s fee limitation for individual requests for PHI, 45 C.F.R. § 164.524(c)(4),
continues to apply when an individual’s request for PHI directs the PHI to be sent to a third-party
in accordance with 45 C.F.R. § 164.524(c)(3)(ii). Guidance at 17–18. The second portion
publicly clarifies HHS’s position about what 45 C.F.R. § 164.524(c)(4)(i) has always meant by
allowing covered entities to charge labor costs for copying. Guidance at 8, 11–13. “[T]he case
law is clear” that such agency action is unreviewable and non-final “where an agency merely
expresses its view of what the law requires of a party, even if that view is adverse to the party.”7
Ctr. for Auto Safety v. Nat’l Highway Traffic Safety Admin., 452 F.3d 798, 808 (D.C. Cir. 2006)
(citation omitted). The third challenged portion of the guidance suggests three ways in which
covered entities may calculate their limited fee under Section 164.524(c)(4). Guidance at 14–16.
That portion of the guidance is expressly permissive and merely provides options for covered

6

Defendants concede that its issuance of the guidance constitutes “agency action” under the
APA. See 5 U.S.C. § 551(4).
Indeed, if HHS were to issue guidance saying that the rule allows for costs associated with
search and retrieval of an individual’s PHI to fall within “labor for copying” costs, as Ciox
appears to prefer, such guidance would appear to impose additional obligations on requestors
beyond those set forth in the regulation, since copying is a separate task from search and
retrieval, and therefore would appear to constitute final agency action under the APA. E.g., Nat'l
Min. Ass'n v. Jackson, 768 F. Supp. 2d 34, 44 (D.D.C. 2011) (concluding that the challenged
agency action amounted to final action because the agency appeared to impose “an additional
step to the permitting process that is not contemplated or set forth in the [prior] guidelines”).

7

25

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 32 of 34

entities, as evidenced by its use of language like “may” and “can.” E.g., Guidance at 15 (“The
following methods may be used . . . .”); see Ass’n of Flight Attendants-CWA, AFL-CIO v.
Huerta, 785 F.3d 710 (D.C. Cir. 2015) (relying on similarly permissive language as evidence
that “the provisions that follow are meant to be precatory, not mandatory”) (citation omitted).
HHS takes the position that covered entities may calculate their fees in different ways so long as
they comply with Section 164.524(c)(4). None of these aspects of the guidance alters the legal
regime under which the relevant regulated parties operate,8 and an agency action will only be
final where its effect is “a certain change in the legal obligations of a party[.]” Nat'l Ass'n of
Home Builders v. Norton, 415 F.3d 8, 15 (D.C. Cir 2005). Further, HHS retains complete
discretion to rescind or change this guidance, which HHS concedes has no force or effect of law
and does independently not bind any covered entity.
Indeed, the guidance amounts to no more than a general statement that explains HHS’s
current understanding of the relevant law or, at most, interpretive, non-final guidance in part. .

8

Ciox’s allegation that these statements constitute “dramatic changes” to the legal framework
are unsubstantiated. See Compl. ¶ 51; see also id. ¶ 48. These bare assertions are undercut by the
language in 45 C.F.R. § 164.524 as well as the guidance itself.
The only portion of the guidance for which Ciox attempts to substantiate this claim is the
guidance regarding the “labor for copying” costs that may be passed to the individual. There,
Ciox relies on language in the preamble to the final rule to argue that the guidance works a
change. See Compl. ¶ 52. Ciox’s reliance on this language is misplaced. The preamble mentions
that “compiling, extracting, scanning, and burning” the PHI could be viewed as included labor
costs. 78 Fed. Reg. at 5636. Those tasks are distinct from “locating, reviewing, . . . and
segregating or otherwise preparing” the PHI that the guidance clarifies to be outside the scope of
the 2013 rule’s “labor for copying” language. Even if the language were somehow inconsistent,
it is well-settled that a rule’s preamble is not binding. See Nat'l Wildlife Fed. v. EPA, 286 F.3d
554, 569–70 (D.C. Cir. 2002) (“The preamble to a rule is not more binding than a preamble to a
statute. ‘A preamble no doubt contributes to a general understanding of a statute, but it is not an
operative part of the statute and it does not enlarge or confer powers on administrative agencies
or officers.’”) (quoting Ass’n of Am. R.Rs. v. Costle, 562 F.2d 1310, 1316 (D.C. Cir. 1977)).The
guidance notes that HHS has always applied the “labor for copying” language to exclude costs
for search and retrieval.
26

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 33 of 34

Huerta, 785 F.3d at 719 (concluding that the challenged agency action was not final, regardless
of whether it was found to be a general statement of policy or an interpretive rule, because it was
“nonbinding guidance that does not conflict with existing regulations”); see also, e.g., Sec. Indus.
& Fin. Markets Ass'n v. United States Commodity Futures Trading Comm’n, 67 F. Supp. 3d 373,
425 (D.D.C. 2014).
To be sure, it is possible for documents styled as guidance to amount to final agency
action if the guidance has an independently binding and legally consequential effect. See
Appalachian Power Co. v. EPA, 208 F.3d 1015, 1023 (D.C. Cir. 2000). Here, however, “there
has been no ‘order compelling the regulated entity to do anything.’” McCarthy, 758 at 253
(quoting Indep. Equip. Dealers Ass’n v. EPA, 372 F.3d 420, 428 (D.C. Cir. 2004)). “[T]he
document itself would [not] be given any weight at all in [subsequent] proceedings.” Molycorp,
Inc. v. EPA, 197 F.3d 543, 546 (D.C. Cir. 1999), because the source of authority for any potential
enforcement activity undertaken by HHS flows from the 2009 statute and the 2013 Rule, not the
guidance.9 See generally Davis Letter; see also 42 U.S.C. § 17935; 45 C.F.R. § 164.524.
Accordingly, this is not a situation in which the challenged document “reads like a ukase”
that “commands[,]” “requires[,]” and “dictates.” Appalachian Power Co., 208 F.3d at 1023. To

9

Using the factors provided by the D.C. Circuit for differentiating between general statements of
policy and legislative rules, this court should not consider the guidance to be a legislative rule.
McCarthy, 758 F.3d at 252-53 (considering (1) “the actual legal effect (or lack thereof) of the
agency action in question on regulated entities”; (2) “the agency’s characterization of the
guidance”; and (3) “whether the agency has applied the guidance as if it were binding on
regulated parties.”). First, HHS considers the guidance as having no legal effect, as it contains no
independently and not binding on any covered entities, which are free to interpret the regulations
in a different lawful way than the agency interpretation. Second, Ciox has not substantiated its
allegations that HHS has applied the guidance as binding. See generally Compl. The letter it
attaches merely refers CHI St. Francis to the guidance (1) for further explanation regarding the
various methods that may be used to calculate a reasonable, cost-based fee for the provision of
PHI at the behest of an individual request and (2) for “material explaining the [regulatory]
provisions related to Access to Medical Records[.]” Davis Letter at 4, 5.
27

 Case 1:18-cv-00040-APM Document 9-1 Filed 04/02/18 Page 34 of 34

the extent that the guidance contains mandatory language, it is clear from context that the agency
does not believe that the guidance itself requires regulated parties to do anything; HHS is instead
expressing its nonbinding view that other legal authorities require particular actions in certain
circumstances. See, e,g., Guidance at 8, 11–13 (explaining HHS’s views about what tasks are
included under “labor for copying” under 45 C.F.R. § 164.524(c)(4)(i)).
Therefore, in the event that this Court concludes that it has jurisdiction to hear Ciox’s
claims, Counts Two and Three should be dismissed under Fed R. Civ. P. 12(b)(6) for failure to
challenge a final action under the APA.
CONCLUSION
For the foregoing reasons, Ciox’s Complaint should be dismissed.

Respectfully submitted,
Dated: April 2, 2018

`

CHAD A. READLER
Acting Assistant Attorney General
JESSIE K. LIU
United States Attorney
JOEL McELVAIN
Assistant Director
/s/ Vinita B. Andrapalliyal
Vinita B. Andrapalliyal
Trial Attorney
United States Department of Justice
Civil Division
Federal Programs Branch
P.O. Box 883
Washington, DC 20044
Tel: (202) 305-0845
vinita.b.andrapalliyal@usdoj.gov

28

 Case 1:18-cv-00040-APM Document 9-2 Filed 04/02/18 Page 1 of 1

UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF THE DISTRICT OF COLUMBIA
CIOX HEALTH, LLC,
Plaintiff,
v.
ALEX M. AZAR II, Secretary of Health
and Human Services, et al.,
Defendants.

)
)
)
)
)
)
)
)
)
)
)

Case No. 1:18-cv-00040 (APM)

[PROPOSED] ORDER
The Court having considered Defendants’ Motion to Dismiss and the parties’
submissions relating thereto, it is hereby
ORDERED that the Motion is GRANTED. It is further
ORDERED that the Complaint is DISMISSED.
SO ORDERED.

_______________________
Date

________________________
Amit P. Mehta
United States District Judge