Opinion ID: 6323814
Heading Depth: 2
Heading Rank: 2

Heading: Ciox’s Declaration

Text: Even if the allegations in the complaint were not enough, Ciox also submitted a declaration from a senior vice president of operations. The declaration asserted that Ciox had fulﬁlled about 727,500 relevant requests for medical records in Wisconsin from late January 2015 to late January 2021 (a period based on Ciox’s estimate of the applicable statute of limitations). These were requests “made by Wisconsin residents to healthcare providers located in Wisconsin for electronic copies of medical records in which a fee was charged or for copies of medical records in which an electronic delivery and/or archive fee was charged.” To reach the $5 million threshold on compensatory damages alone, these requests would need to average only around $6.88 in overcharges. Given that Schutte’s claimed compensatory damages were $61, this estimate is also suﬃcient to meet Ciox’s burden. Schutte argues that the declaration is not suﬃcient. She says that from 2016 to 2020, requests for records could be priced under either federal law or Wisconsin law, and that only requests in the latter category would be relevant to this action. Since Ciox has not speciﬁed how many of the 727,500 requests were priced under Wisconsin law, Schutte argues, the declaration is overinclusive. The argument does not defeat CAFA jurisdiction. There is at best for Schutte some room to argue about the relevant time for class members’ claims. At the risk of digging a little too deeply into the merits at this stage, federal regulations known collectively as the HIPAA Privacy Rule provide that a covered entity fulﬁlling a request for medical records “may impose a No. 22-1087 11 reasonable, cost-based fee.” 45 C.F.R. § 164.524(c)(4) (2020). 2 Another regulation clariﬁes how this provision interacts with state laws regulating fees: “When a State law provides a limit on the fee that a covered entity may charge for a copy of protected health information, this is relevant in determining whether a covered entity’s fee is ‘reasonable’ under § 164.524(c)(4).” Modiﬁcations to the HIPAA Privacy, Security, Enforcement, and Breach Notiﬁcation Rules, 78 Fed. Reg. 5566, 5636 (Jan. 25, 2013). If state law limits the permissible charges to 25 cents per page, for example, then the covered entity may not charge more than that amount even if its costs are higher. Id. So Wisconsin’s prohibition on fees for electronic copies of medical records, see Banuelos, 966 N.W.2d at 87, would at least arguably apply to requests that were priced under federal law. This question about the interplay of federal and state limits on record fees need not be resolved on the merits at this stage, however. The question here, we repeat, is the extent of the controversy, not its likely resolution. 3 2 The relevant regulations refer only to “covered entities,” not “business associates,” and Ciox falls in the latter category. Ciox Health, LLC v. Azar, 435 F. Supp. 3d 30, 39 (D.D.C. 2020). As the Ciox Health court observed, however, “HHS’s regulations all but ensure that business associates will limit the fees they charge in a manner consistent with HHS’s interpretation of the [restrictions imposed by the regulations]. The regulations expressly make covered entities liable for their business associates’ violations.” Id. at 49; see also id. at 49–50 (noting that covered entities “have structured their contracts to require their business associates to follow the regulations” and that Ciox’s contracts “include provisions requiring Ciox to indemnify the covered entity for any violation … that is attributable to the covered entity for Ciox’s actions” (citation omitted)). 3 Schutte suggests that some charges for electronic records—such as retrieval fees or certification fees—might still be permissible, pointing out that only per-page paper copy charges were directly at issue in Banuelos. 12 No. 22-1087 Even if we accepted Schutte’s theory that we should disregard four of the six years covered by the Ciox declaration, her argument would still fail. Assuming the requests were evenly distributed over the six years, the last two years would have included more than 200,000 requests. Those requests would have needed to average only $25—less than half of Schutte’s alleged damages—to surpass the $5 million threshold with compensatory damages alone, and we may not disregard Schutte’s demand for exemplary damages. These estimates are also suﬃciently plausible to satisfy the amount-in-controversy requirement. Schutte’s other fundamental objection to the declaration is that it oﬀers “no evidence” about the average charge for the 727,500 requests. Again, however, Schutte exaggerates Ciox’s burden. All Ciox needed to do at this stage was come forward with a plausible, good-faith estimate that the stakes exceed $5 million, which it did by oﬀering the estimate of 727,500 requests. Even where there is “more that [the defendant] could have done,” we accept such an estimate “unless it is legally impossible for the plaintiﬀ to recover that much.” Blomberg, 639 F.3d at 764 (ﬁnding amount-in-controversy requirement satisﬁed even though defendant could have provided more See 966 N.W.2d at 80. This argument is another invitation to confuse the merits with the amount that plaintiff has put in controversy by her own allegations. Schutte’s complaint defines the class in terms of charges for “‘paper copies’ fees for electronic copies, electronic archive data fees, and other similar impermissible fees.” (Emphasis added.) That language puts retrieval fees and certification fees for electronic records “in controversy” regardless of how these issues might ultimately be resolved as a matter of Wisconsin law. See also id. at 83 (“[A] health care provider that complies with a request to provide electronic copies of a patient’s health care records may not charge a fee for doing so.”). No. 22-1087 13 speciﬁc estimates about the damages at issue); see also Brill, 427 F.3d at 448 (“Once the proponent of jurisdiction has set out the amount in controversy, only a ‘legal certainty’ that the judgment will be less forecloses federal jurisdiction.”). Defendants have satisﬁed CAFA’s amount-in-controversy requirement.