From a blog post on JD Supra:
In the wake of the 2019 United States Department of Health and Human Services, Office of Civil Rights (“OCR”) enforcement actions against Bayfront Health St. Petersburg (“Bayfront”) and Korunda Medical, LLC (“Korunda”) pursuant the HIPAA and HITECH Right of Access Initiative—for violations of the rights of patients to obtain access to their medical records promptly, without being overcharged, and in the readily producible format of their choice—private lawsuits have been on the rise to enforce patients’ right to access.
Of most recent note, the matter Russell v. Healthalliance Hospital Broadway Campus, and Ciox Health, LLC, 1:20-cv-01204 (USDC No. Dist. of NY), seeks not only monetary damages for failing to grant access to the medical records of the deceased husband of the Plaintiff, but also certification of a class action on behalf of those similarly situated. ...
Given the fact that 42 U.S.C. § 1320d-5 provides for penalties of $50,000 per violation and up to $1,500,000 in fines per calendar year, the prospect of class actions under this law are to be taken very seriously. ...
If you work at Social Security, you may wonder why I post this. If you represent claimants, you know all too well. Almost all larger medical providers and some who aren't all so large have entered into contracts with outside companies, such as Ciox, to handle medical records requests for them. It's obvious that these companies, if not the medical providers, regard responding to medical records requests as an opportunity to gouge the requesters. It's a monopoly situation. If my client was treated at a particular hospital or medical practice, there's only one place I can go to get those medical records. There are supposed to be limits on this, provided by HITECH and state laws but these companies try to evade the limits with ever more inventive explanations for why they're allowed to charge more than the law allows. They know in the end we need the records now and we'll have to pay up. We file complaints with the OCR but those take time and the medical records companies involved are almost never punished for their outrageous behavior. The situation has devolved into almost hand to hand combat. Class actions sound like a good idea to me.