Opinion
FLIER, J.Appellants Frank Bugarin and the law firm Mann & Cook filed a class action against respondent ChartOne, Inc., contending that fees charged by ChartOne for copying Bugarin’s medical records were excessive. The trial court sustained ChartOne’s demurrer to the original complaint without leave to amend. We affirm.
FACTS
According to the allegations of the complaint, which, for the purposes of the demurrer, we accept as true (5 Witkin, Cal. Procedure (4th ed. 1997) *1560Pleading, § 903), Bugarin, “acting through his agent, plaintiff Mann & Cook, his lawyers, ordered copies of his medical records for use in his own excessive force lawsuit directly from his health care provider, Rancho Los Amigos Medical Center in the City of Downey, County of Los Angeles.”
ChartOne, who the complaint alleges is a “stranger” to appellants, contracts with health care providers (hereafter referred to as providers) for the exclusive franchise to manage and copy health care records generated by the providers. In the case of providers under contract with ChartOne, the only source for copies of medical records is ChartOne. When a provider receives a request for copies of health care records, the provider forwards the request to ChartOne. ChartOne accesses the patient’s records through an agent who copies the record on the provider’s premises. The copies are then sent by ChartOne to the patient or the patient’s representative, and ChartOne sends a bill for the copies to the patient or his or her representative. In return for obtaining these exclusive franchises, ChartOne furnishes free copying services to, and confers other unspecified benefits on, providers.
The complaint alleges that ChartOne charges substantially above the per-page cost of copying for patients who request copies of their records and that ChartOne charges even higher fees when patients request their records through their attorneys. Patients must pay these fees because they have no other means of getting copies of their health records.
The United States Department of Health and Human Services (DHHS) has promulgated regulations under the Health Insurance Portability and Accountability Act (HIPAA)1 2for the management and transmission of health care records. The regulation that the complaint alleges applies to Bugarin’s request for a copy of his medical records is 45 Code of Federal Regulations part 164.524 (2005). Among other things, this regulation contains a provision governing the fees charged for copying medical records that states:
“(4) Fees. If the individual requests a copy of the protected health information or agrees to a summary or explanation of such information, the covered entity® may impose a reasonable, cost-based fee, provided that the fee includes only the cost of:
*1561“(i) Copying, including the cost of supplies for and labor of copying, the protected health information requested by the individual;
“(ii) Postage, when the individual has requested the copy, or the summary or explanation, be mailed; and
“(iii) Preparing an explanation or summary of the protected health information, if agreed to by the individual as required by paragraph (c)(2)(ii) of this section.” (45 C.F.R. § 164.524(c)(4) (2005).)
With specific reference to Bugarin, the complaint alleges that Bugarin was charged by ChartOne $0.31 per page for copying and that this exceeds the actual cost of copying. In addition, Bugarin was charged an unexplained “base fee” of $24.06. According to the complaint, the copying fees actually charged, and the “base fee” charge, exceed the “cost of copying” limit set forth in 45 Code of Federal Regulations part 164.524(c)(4) (2005). For the purposes of this appeal, we must accept this factual allegation as true.
Pursuant to the retainer agreement with Bugarin, Mann & Cook advanced, and has paid, the fees demanded by ChartOne.
The complaint sets forth a class of “[a]ll persons nationwide who requested copies of their health records from their health care providers acting through their lawyers for use in their lawsuits,” who had their request processed by ChartOne beginning on April 14, 2003. (The federal regulations at issue became effective on April 14, 2003.)
The complaint alleges causes of action under Business and Professions Code section 17200 et seq., under Civil Code section 52.1 (civil action for the protection of rights secured by laws of the United States), and for declaratory and injunctive relief. The factual predicate for each of these causes of action is that the fees charged by ChartOne for a copy of Bugarin’s medical record violates 45 Code of Federal Regulations part 164.524(c)(4) (2005).
DISCUSSION
1. The Statutory and Regulatory Scheme
In enacting HIPAA, Congress expressed its concern for protecting the integrity and confidentiality of personal medical records, and for preventing the unauthorized use or disclosure of such records. (42 U.S.C. *1562§ 1320d-2(d)(2).) Responding to the congressional mandate, DHHS promulgated comprehensive regulations .to protect the privacy of personal medical records. The regulations most pertinent to this appeal now appear at 45 Code of Federal Regulations part 164 (2005), are entitled “Security and Privacy,” and are hereafter referred to as “part 164.” Part 164 governs the management and disclosure of medical records by “covered entities,” which are defined in part as “health plans.” (42 U.S.C. § 1320d-l(a); 45 C.F.R. § 160.103(3) (2005).)3
Part 164 provides for the right of access by an individual to his or her own medical records. With the exception of certain narrowly defined types of situations, an individual “has a right of access to inspect and obtain a copy of protected health information.” (45 C.F.R. § 164.524(a) (2005).) “The covered entity must provide the access requested by individuals, including inspection or obtaining a copy, or both, of the protected health information.” (§ 164.524(c)(1) (2005), italics added.)
“Personal representatives” are to be treated “as the individual” for the pur poses of part 164. (45 C.F.R. § 164.502(g)(1) (2005).) In substance, a personal representative is defined as a person who holds a healthcare power of attorney for an adult, a parent or guardian of a minor, or an executor or administrator of an individual’s estate. (45 C.F.R. § 164.502(g)(2)-(4) (2005).) Attorneys retained by an individual are not included in the definition of a personal representative.
While, as noted, part 164 requires a covered entity to provide access requested by individuals and by personal representatives of individuals, part 164 prohibits the disclosure of protected health information without an authorization.4 Part 164.508 comprehensively governs the form and content of authorizations, including defining the “core elements” of a valid authorization.5 (45 C.F.R. (2005).) A valid authorization is not a casual matter, and is subject to stringent requirements. (See fn. 5, ante.)
*156345 Code of Federal Regulations part 164.524 is entitled “Access of individuals to protected health information.” (45 C.F.R. (2005).) As noted, it contains a provision, subpart (c)(4), that governs the fees for the copying of records. (See text, ante.) The limitation on fees that is imposed by subpart (c)(4) is intended to ensure that all individuals can obtain access to their medical records, and not only those who can afford it. (67 Fed.Reg. 53182, 53254 (Aug. 14, 2002).) Subpart (4) falls under part 164.524(c), which begins: “(c) Implementation specifications-. Provision of access. If the covered entity provides an individual with access, in whole or in part, to protected health information, the covered entity must comply with the following requirements.” Subpart (c)(1) states that the covered entity “must” provide access; states that access must be provided in the format requested; addresses regulations about the time and manner of access; and, as noted, deals with fees charged for copying records. (45 C.F.R. § 164.524(c)(l)-(4) (2005).)
We note that the entirety of 45 Code of Federal Regulations part 164.524 (2005), including subpart (c)(4), deals with the access by individuals to their own medical records. Part 164 recognizes two interests; they are the right of an individual to his or her own medical records, and the importance of protecting the privacy and integrity of those records. Thus, part 164 grants an individual rights and protections that are personal, and that are to be exercised personally. In other words, the word “individual” in part 164 is used with the intent to describe a natural person who is the subject of medical records or, in the words of the federal regulations, who is the subject of “protected health information.”
The structure of part 164 confirms this interpretation. In the interest of giving an individual free access to his or her own medical records, the covered entity is under an absolute obligation to furnish those records on request. (45 C.F.R. § 164.524(c)(1) (2005).) Privacy concerns do not arise when the individual requests his or her own records; thus, the right to the records is absolute when the individual requests them. Some flexibility is introduced by giving specifically defined “personal representatives” the same right of access as individuals.
Privacy concerns arise when the request is made by someone other than the individual or the personal representative. Those concerns are met by enter*1564taining such requests, but only when they meet the stringent requirements of a valid authorization. (45 C.F.R. § 164.508 (2005); see text, ante, and fn. 4.) The fact is that a request by someone other than the individual or the personal representative raises privacy concerns. This is why, for the purposes of part 164, individuals cannot be conflated with “agents” or, for that matter, with lawyers who purport to represent an individual.
As respondent points out, there is evidence that DHHS .considered and rejected giving lawyers the status of a personal representative, or conflating individuals with their lawyers for the purpose of defining an “individual.” In commenting on its regulations, DHHS stated: “In the final rule, we eliminate from the definition of ‘individual’[6] the provisions designating a legal representative as the ‘individual’ for purposes of exercising certain rights with regard to protected health information. Instead, we include in the final rule a separate standard for ‘personal representatives.’ A covered entity must treat a personal representative of an individual as the individual except under specified circumstances.” (65 Fed.Reg. 82462, 82492 (Dec. 28, 2005).)
We are not unmindful of the fact that, in certain areas of practice, lawyers routinely request copies of their clients’ medical records. The effect of such requests by lawyers is to increase the cost to the client, even though the intent of the legislation, and the regulations, is to minimize the cost of copying, at least when an “individual” requests his or her own records. One solution is to publicize part 164 more broadly, so that lawyers and their clients can make an informed decision. We are not, however, free to deviate from the text of part 164 simply because some lawyers may be uninformed about this provision.
In light of the foregoing, we conclude that an “individual” for the purposes of part 164 is a natural person who is the subject of protected health information. This is in keeping with the regulatory scheme that guarantees an individual access to his or her own medical records, while it limits access by third parties to those who hold valid authorizations.
2. There Is No Significant Curtailment of Appellant’s Rights and Interests By Requiring Him to Request His Medical Records Personally
The complaint alleges that “Plaintiff BUGARIN, acting through his agent, plaintiff MANN & COOK, his lawyers, ordered copies of his medical records *1565for use in his own excessive force lawsuit directly from his health care provider, Rancho Los Amigos Medical Center.” The parties interpret this allegation- to mean that the request for Bugarin’s medical records was made by the law firm of Mann & Cook, and not by Bugarin personally.
The law firm of Mann & Cook is not an “individual” who is the subject of protected health information. Thus, Mann & Cook is not entitled to the cost-based fees required by 45 Code of Federal Regulations part 164.524(c)(4) (2005) and, for this reason, the demurrer to appellant’s complaint was properly sustained.
This is not the end of the line for appellant. The simple and direct alternative that is open to him is to request his own medical records from his provider and, having received them, hand them to his lawyer. The rules that require this slightly circuitous procedure are in place to protect individual privacy; the very minor inconvenience of asking for one’s own records is a small price to pay for rules that protect the privacy of medical records.
3. Appellant’s Contentions Are Without Merit
Appellant relies on the body of law that provides, in broad terms, that a lawyer is the client’s agent. Appellant contends that, for this reason, the lawyer’s request for medical records is actually the client’s.
We agree that the lawyer is the client’s agent, but we do no think that, for the purposes of protecting the privacy of medical records, a lawyer’s request is the same as the client’s personal request for his or her own medical records. The problem that appellant’s argument sidesteps is that a request by anyone other than the individual or his/her personal representative as defined in the regulations raises serious privacy concerns. DHHS considered but rejected giving lawyers the same status as personal representatives. This court is not empowered to redraft federal regulations, especially when the regulations do not impinge on fundamental rights. As noted, all appellant has to do is to request a copy of his own records. We do not perceive that there is any “right” to have one’s lawyer ask for one’s records.
In their briefs, the parties advise us of the economic considerations that they claim underlie this controversy. We cannot consider facts that are outside the complaint. (Ard v. County of Contra Costa (2001) 93 Cal.App.4th 339, 347 [112 Cal.Rptr.2d 886]; see generally 5 Witkin, Cal. Procedure (4th ed. 1997) Pleading, § 900.)7
*1566We conclude that 45 Code of Federal Regulations part 164.524(c)(4) does not apply to the request made by Mann & Cook and that, for this reason, the fees charged for copying appellant’s records do not violate part 164.524(c)(4). Thus, the essential factual predicate for each of appellant’s causes of action, an unlawful act by respondent, is missing. This flaw cannot be cured by an amendment. For this reason, the order sustaining respondent’s demurrer without leave to amend is affirmed.
DISPOSITION
The judgment is affirmed. Respondent is to recover its costs on appeal.
Cooper, R J., and Rubin, J., concurred.
Title 42 United States Code section 1320d et seq.
See footnote 3, post.
“Covered, entity means: [ft] (1) A health plan, [ft] (2) A health care clearinghouse, [ft] (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.” (45 C.F.R. § 160.103 (2005).)
“Except as otherwise permitted or required by this subchapter, a covered entity may not use or disclose protected health information without an authorization that is valid under this section. When a covered entity obtains or receives a valid authorization for its use or disclosure of protected health information, such use or disclosure must be consistent with such authorization.” (45 C.F.R. § 164.508(a)(1) (2005).)
“(1) Core elements. A valid authorization under this section must contain at least the following elements: [ft] (i) A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion, [ft] (ii) The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure, [ft] (iii) The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure, [ft] (iv) A *1563description of each purpose of the requested use or disclosure.... [1] (v) An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. . . . [IQ (vi) Signature of the individual and date. If the authorization is signed by a personal representative of the individual, a description of such representative’s authority to act for the individual must also be provided.” (45 C.F.R. § 164.508(c)(1) (2005).)
In the regulations currently in effect, there is no definition of an “individual.” (See 45 C.F.R. § 164.501 (2005).) At one point, DHHS contemplated defining “individual” as a person who is the subject of personal protected health information. (65 Fed.Reg. 82462, 82492 (Dec. 28, 2000).)
We note only in the margin as irrelevant to our analysis and disposition the parties’ representations that 50 percent of all requests for records come from lawyers acting for their clients, and only 2.5 percent are made by individuals. Even if we could take note of these *1566facts, if they are facts, the economic consequences and burdens of these federal regulations are for DHHS and the Congress, and not this court.