# authority.md — mva-records-request

Canonical text lives in `mo-authority.md` (bundled). This file is the records slice.
**Verified July 16, 2026.** Legend: ✅ verified · 🔶 new · ⚠️ corrected · ⛔ open, do not state.

## The HIPAA fee rules, and what *Ciox* actually did

### 45 C.F.R. § 164.524(c)(4) ✅ — the Patient Rate

The fee may include **only**: labor for copying; supplies for paper or portable media; postage when
mailing was requested; preparing an agreed summary or explanation.
**Search and retrieval time is NOT on the list.** That is the whole gap between the Patient Rate and
a Missouri provider's § 191.227 charge.

### *Ciox Health, LLC v. Azar* ✅ — full opinion verified

**Cite: No. 18-cv-00040 (APM) (D.D.C. Jan. 23, 2020) (Mehta, J.), Mem. Op., ECF No. 51.**
⛔ **435 F. Supp. 3d 30 is NOT confirmed.** The docket is captioned ***CIOX HEALTH, LLC v. HARGAN***
(acting Secretary at filing), which is why citation lookups miss it. **Cite by docket.**

**The court vacated two things:**
1. 🔶 **The 2013 Omnibus Rule**, insofar as it expanded the HITECH third-party directive beyond
   **EHRs in electronic format**. Everything else needs a § 164.508 authorization. This is the
   **bigger** holding and it is commonly missed.
2. **The 2016 Guidance**, insofar as it extended the Patient Rate to third-party directives —
   **on notice-and-comment grounds only**.

**What survived:** the labor-cost exclusion (search/retrieval not recoverable) — held an
**interpretive** rule. And the three calculation methods claim was **dismissed** as not final agency
action; the **$6.50 flat fee is one option of three and expressly NOT a cap**.

⚠️ **The vacatur was PROCEDURAL.** The court **expressly declined the merits** to avoid foreclosing
HHS from revisiting scope. **HHS can redo this by rulemaking.** Treat as contingent — review trigger.

⚠️ **The distinction is NOT "attorney-directed vs. client-directed":**

| Request type | Patient Rate? |
|---|---|
| **Personal-use** — patient asks for her own records | **Applies** |
| **Third-party directive** — patient directs records to the firm | **Not capped after *Ciox*.** Directive right now reaches only EHRs in electronic format. |
| **Third party's own request** with a HIPAA authorization | **Never was capped.** |

**Enforcement wrinkle:** HHS's Fact Sheet says it "lacks the authority to enforce the 'reasonable,
cost-based fee' limitation… against business associates" — but **45 C.F.R. § 160.402(c)(1)** ✅ makes
the **covered entity** liable for its business associate's acts as agent. Fee discipline propagates.

### Missouri

- **§ 191.227** ⛔ — written request, fee structure, **annual CPI adjustment**. Not pulled. Review
  trigger.
- **Ch. 610 (Sunshine Law); § 43.512** ⛔ — crash reports. Not pulled.
- **§ 490.680** ⛔ — business-records affidavit. **Request it alongside the records.** One sentence;
  saves a deposition.
- **45 C.F.R. § 164.508** ⛔ — authorization core elements. Not pulled.

## 🔶 The demand statutes make this a records skill

**§ 408.040.3(3)** ✅ requires a compliant prejudgment-interest demand to enclose a **provider list**,
**copies of all reasonably available medical bills**, an **employer list** if wage loss is claimed,
and **written authorizations** letting the party and the insurer obtain those records.
**§ 537.058.3** ✅ requires a provider list + **HIPAA-compliant authorizations**, and an employer list
+ authorizations if wage loss is asserted.

**A compliant demand is a records-production event.** Build the authorization set here, at the
records stage, not at the demand stage. *Emery v. Wal-Mart Stores, Inc.*, 976 S.W.2d 439 (Mo. banc
1998) ✅ — **actual notice does not cure a formal defect.**

## 🔶 Lien-side letters — the money side, currently unbuilt

- **ERISA plan documents.** **29 U.S.C. § 1024(b)(4)** ✅ is the **duty**: the administrator "shall,
  upon written request of any participant or beneficiary, furnish a copy of… the instruments under
  which the plan is established or operated." The **penalty is a different section** —
  **29 U.S.C. § 1132(c)(1)(B)** ✅: "**may in the court's discretion** be personally liable… **up to
  $100 a day**," running from **30 days after the request**. Discretionary. Personal to the
  administrator. 29 C.F.R. § 2575.502c-1 ✅ adjusts the figure; ⛔ current amount not pulled.
  **Cite as leverage, not entitlement.** *McCutchen*, 569 U.S. 88 (2013) ✅ turns on the plan text —
  a **silent plan** lets the common-fund doctrine reduce the lien. **Request it early.**
- **Medicare conditional payment letter** to the BCRC. 42 U.S.C. § 1395y(b)(2) ✅;
  42 C.F.R. § 411.24(g) ✅ (right of action against the **attorney**); § 411.24(h) ✅ (60 days);
  § 411.24(i)(1) ✅ (primary payer pays **twice**).
- **MO HealthNet lien inquiry.** *Gallardo v. Marstiller*, 596 U.S. 420 (2022) ✅ reaches **future**
  medicals.
- **Hospital lien verification** — §§ 430.230, 430.240 ⛔ not pulled. **§ 190.250** ✅ gives
  **ambulance services** the same rights. In nearly every file.

## Wage loss

The W-2 template produces nothing usable for a self-employed or 1099 claimant. Add a variant
requesting **Schedule C, 1099s, and a period-over-period P&L**.

## Track four numbers, not one

Billed / adjusted / paid / outstanding. § 490.715.5 ✅ made **actual cost** the operative measure in
2017. The chronology and the demand table both inherit this. See `mo-authority.md` § 4.

## Coverage disclosure — a request, not a demand

⛔ **No verified Missouri statute compels a liability insurer to disclose policy
limits pre-suit.** § 375.1007 (unfair claims settlement practices) is **not pulled**
and should not be cited for this proposition without checking; the same goes for any
2023–2026 amendment. Draft the coverage-disclosure letter as a courteous written
request, note to the attorney that it is unenforceable as drafted, and let the
attorney decide whether to escalate. **Do not imply an obligation that has not been
verified** — that is the exact failure this library exists to prevent.

Limits still drive everything downstream: the valuation range, the UIM offset, and
whether the § 537.065 path is live. Ask early even though you cannot compel.