Have you noticed that none of your MRO requests have come through yet this year? Or maybe you’ve found yourself stuck on hold forever when trying to reach MRO? If so, you’re far from alone. Here’s what’s happening—and why it matters.
The HHS Final Rule and Its Impact
On June 25, 2024, the Office for Civil Rights (OCR)—part of the U.S. Department of Health and Human Services (HHS)—issued a Final Rule with a compliance date of December 23, 2024. This rule effectively prohibits health care providers, health plans, and their business associates from using or disclosing Protected Health Information (PHI) for certain “Prohibited Purposes.” Specifically, PHI cannot be used or disclosed if the request aims to conduct a criminal, civil, or administrative investigation—or to impose liability—related to lawful reproductive healthcare (including abortion) or to identify a person involved in such healthcare.
In essence, the OCR is doubling down on protecting patient privacy around reproductive healthcare. This is intended to build trust between patients and providers and to ensure access to lawful care without fear of reprisal.
Why This Affects Personal Injury or Workers’ Comp Requests
If you’re a law firm handling personal injury or workers’ compensation cases, you may be wondering how this rule—focused on reproductive healthcare privacy—suddenly impacts your routine record requests.
Our initial theory is two-fold:
1. Blanket Approach to Compliance
MRO appears to be applying a universal policy for all third-party medical record requests. In other words, rather than distinguishing which requests relate to reproductive healthcare and which don’t, MRO requires an attestation form across the board.
2. Potential Avoidance of HITECH Requests
Under the HITECH Act, medical record requests made on behalf of the individual are capped at $6.50. In contrast, third-party requests can be billed on a per-page basis (often around $1 per page, varying by state). By insisting that every third-party request must include a signed attestation (confirming that it isn’t for a prohibited purpose), MRO can classify more requests as third-party, potentially leading to higher fees.
MRO’s Attestation Form Requirement
As of now, MRO is the only release-of-information service we’ve found that insists on this attestation form. It requires you to affirm that the requested PHI is not being sought for any prohibited reproductive-health investigation. Completing this form effectively brands the request as “third party,” eliminating any chance to argue for a HITECH-based, individual request fee.
What We’ve Heard from MRO
We’ve reached out to MRO multiple times but couldn’t get past the initial support lines. The representatives mentioned that law firms nationwide are calling in with the same concerns. MRO hasn’t provided a clear justification beyond stating that the attestation is mandatory for all third-party requests, regardless of whether they involve reproductive healthcare or something like a motor vehicle accident.
What This Means for Your Practice Right Now
1. You Must Sign the Attestation Form
There’s currently no workaround. Even if your HIPAA Authorization explicitly states you’re not requesting records related to reproductive healthcare, MRO is still requiring the form.
2. No Waiver
MRO does not allow you to waive this requirement. Their policy remains firm, even if your case has zero link to sexual or reproductive health services.
3. Expect Delays
Extended wait times have become the norm. Be prepared for longer turnaround on requests and prolonged call queue delays at facilities served by MRO.
Final Thoughts
While the OCR’s Final Rule aims to protect patient privacy regarding reproductive healthcare, it has inadvertently introduced significant roadblocks for law firms seeking routine records in personal injury or workers’ compensation matters. For now, you’ll need to factor these delays into your workflow and ensure all third-party requests include MRO’s required attestation form.
We’ll continue to monitor the situation and provide updates as more information surfaces. If you have a high volume of requests going through MRO, be sure to allocate extra time for fulfillment—and brace for increased fees if MRO continues to categorize requests as third-party rather than individual/HITECH.
Note: This content is for informational purposes and does not constitute legal advice. Always consult with your legal counsel for guidance specific to your jurisdiction and practice.
Looking to improve your firm’s medical record retrieval process?
Learn more about how CatalyzeX’s optimized medical record retrieval solutions can help your firm streamline requests, reduce wait times, and minimize the headaches associated with evolving compliance requirements.
