Opinion by
Judge HAWTHORNE.In this declaratory judgment action challenging the Colorado Board of Health's "patient copy" rule, plaintiff, the Colorado Consumer Health Initiative (CCHIT), appeals the summary judgment entered for defendant, the Colorado Board of Health, as well as the denial of its cross-motion for summary judgment. We affirm the trial court's order denying CCHI's summary judgment motion, reverse its order entering summary judgment for the Board, and remand for further proceedings.
I. Facts
The Colorado Board of Health (the Board) is a state regulatory board that has the authority to adopt and amend rules regarding public health. § 25-1-108(1)(c)(T), CRS. 2009. The Board's rule generally known as the "patient copy rule" establishes the fees that health care facilities can charge for providing copies of a patient's medical records. Standards for Hospitals & Health Facilities Rule 1I-5.2.38.4, 6 Code Colo. Regs. 1011-1.
In 2001, the Association of Health Information Outsourcing Services (AHIOS), a national lobby group for the health information management outsourcing industry, petitioned the Board to increase the copying fees charged to patients and third parties. The Board adopted AHIOS's proposed amendment.
In 2007, AHIOS again petitioned the Board to increase copying fees. However, the 2007 proposed amendment excluded from the fee increase individuals covered by the federal Health Insurance Portability and Accountability Act (HIPAA). To support the proposed fee increases, AHIOS included a self-compiled survey of the copying fees charged to certain third parties (attorneys and insurers) by forty-two other states. CCHI opposed the amendment.
In 2008, the Board adopted AHIOS's 2007 proposed amendment. CCHI subsequently filed a complaint for declaratory relief challenging the Board's rules amending the patient copy rule in 2001 and 2008. On cross-motions for summary judgment, the court granted the Board's motion and denied CCHI's.
CCHI appeals.
IL Standard of Review
We review a summary judgment de novo. Brodeur v. Am. Home Assurance Co., 169 P.3d 139, 146 (Colo.2007). Summary judgment is appropriate only if the pleadings and supporting documents show that there is no genuine, material, factual issue and that the moving party is legally entitled to judgment. Id.
*528The nonmoving party is entitled to all favorable inferences reasonably drawn from the undisputed facts; all doubts must be resolved against the moving party. Id. Cross-motions for summary judgment do not decrease either party's burden of establishing entitlement to summary judgment. Miller v. Hartford Cas. Ins. Co., 160 P.3d 408, 410 (Colo.App.2007). An order denying summary judgment is generally not reviewable unless it effectively ends the litigation. See Mahaney v. City of Englewood, 226 P.3d 1214, 1217 (Colo.App.2009).
When reviewing a challenge to board or agency rules, we presume a rule is valid if it was adopted pursuant to a statutory rule-making proceeding, and the challenging party has the burden to establish the rule's invalidity by demonstrating that it is
arbitrary or capricious, a denial of statutory right, contrary to constitutional right, power, privilege, or immunity, in excess of statutory jurisdiction, authority, purposes, or limitations, not in accord with the procedures or procedural limitations of [the Colorado Administrative Procedure Act (APA)] or as otherwise required by law, an abuse or clearly unwarranted exercise of discretion, based upon findings of fact that are clearly erroneous on the whole record, unsupported by substantial evidence when the record is considered as a whole, or otherwise contrary to law.
§ 24-4-106(7), C.R.S.2009; accord Augustin v. Barnes, 626 P.2d 625, 627 (Colo.1981); McClellan v. Meyer, 900 P.2d 24, 29 (Colo.1995).
"Whenever the scope of review is somewhere between the two extremes of de novo review and complete unreviewability, as it usually is, the key to scope of review is not the choice of formulas or standards, such as 'substantial evidence' or 'arbitrary and capri-clous."" Citizens for Free Enterprise v. Dep't of Revenue, 649 P.2d 1054, 1063 n. 6 (Colo.1982) (quoting K. Davis, Administrative Law Treatise § 29.00-1, at 528 (1982 Supp.)). Rather, "the underlying question is whether the agency action is reasonable." Id.
Moreover, in reviewing an agency action, courts shall determine "all questions of law and interpret the statutory provisions involved and shall apply such interpretation to the facts duly found or established." Transponder Corp. v. Property Tax Administrator, 681 P.2d 499, 503 (Colo.1984) (quoting § 24-4-106(7)); accord State v. Esser, 30 P.3d 189, 194 (Colo.2001) (although courts defer to agency's interpretation of its own enabling statute, "conclusions of law, including interpretations of the constitutions and statutes, are always subject to de novo review").
A rule may not modify or contravene an existing statute, and any rule that is inconsistent with or contrary to a statute is void. Ettelman v. Colorado State Bd. of Accountancy, 849 P.2d 795, 798 (Colo.App.1992); see § 24-4-1083(8)(a), C.R.S.2009 (any rule which conflicts with a statute is void).
Nevertheless, courts should give deference to an agency's construction of the rules it promulgates, as well as the agency's construction of its enabling legislation, "unless the agency's interpretation is not in accordance with law." Esser, 30 P.3d at 193; accord Bd. of County Comm'rs v. Colorado Pub. Utils Comm'n, 157 P.3d 1083, 1088 (Colo.2007). But courts are not bound by an agency's interpretation. Bd. of County Comm'rs, 157 P.3d at 1088. Courts should also give deference to a statute's construction given by the administrative agency charged with its enforcement or administration, unless that interpretation is inconsistent with the statute's clear language or the legislative intent. Meridian Ranch Metropolitan Dist. v. Colorado Ground Water Comm'n, 240 P.3d 382, 387 (Colo.App.2009); Cartwright v. State Bd. of Accountancy, 796 P.2d 51, 53 (Colo.App.1990).
Courts, however, have a duty to invalidate administrative rules that conflict with the statute's design. Cartwright, 796 P.2d at 53.
III Analysis
A. Compliance with HIPAA
CCHI contends that, because the patient copy rule does not comply with HIPAA, the trial court erred in entering summary judgment for the Board and against CCHI. We *529conclude that neither party was entitled to summary judgment on this issue.
We review de novo the legal question of whether the 2001 and 2008 rules amending the Board's patient copy rule violate HIPAA and its related regulations. See Transponder Corp., 681 P.2d at 503 (in reviewing an agency action, courts shall determine all legal questions, interpret the statutory and constitutional provisions involved, and shall apply such interpretation to the facts duly found or established). Moreover, because the Board is charged with administering and enforcing state public health laws and not federal health laws, we need not defer to the Board's HIPAA interpretations. Cf. Meridian Ranch Metropolitan Dist., 240 P.3d at 387, 2009 WL 3765490 (court generally defers to statute's interpretation by agency charged with its enforcement).
1. Legal Principles
HIPAA is federal legislation that mandated reforms regarding health insurance access, portability, renewability, mandatory coverage, and preexisting condition exclusions. Pub.L. No. 104-191, 110 Stat. 1986 (Aug. 21, 1996) (codified primarily in titles 18, 26, and 42 of the United States Code); Usick v. American Family Mut. Ins. Co., 131 P.3d 1195, 1198 (Colo.App.2006).
HIPAA regulations mandate that covered health care entities may only charge a "reasonable, cost-based fee" for providing copies of patient health records, and the fee may only include the cost of "[clopying, including the cost of supplies for and labor of copying ...; [plostage [where applicable}; and [plre-paring an explanation or summary of the protected health information [where applicable]." 45 CFR. § 164.524(c0)(d)0)-0H). However, HIPAA regulations apply only to the "person who is the subject of protected health information" (the patient) or the "person [who] has authority to act on behalf of [a patient] ... in making decisions related to health care" (the patient's "personal representative"). 45 C.FE.R. §§ 160.103, 164.502(g).
HIPAA and its related regulations preempt state laws that are less stringent than HIPAA regulations See HIPAA, Pub.L. 104-191, see. 264(c)(@); South Carolina Med. Ass'n v. Thompson, 327 F.3d 346 (4th Cir.2003). Pursuant to executive order, HIPAA became effective on August 14, 2008. See HIPAA, Pub.L. 107-105, see. 2(b). Thus, as of August 14, 2008, states whose laws were not more stringent were required to comply with HIPAA and its related regulations.
Here, the Board's 2001 rule amending the patient copy rule provided that patients or their personal representatives "shall pay for the reasonable cost of obtaining a copy of [the patient's] records, not to exeeed $14.00 for the first ten or fewer pages, $.50 per page for pages 11-40, and $.33 per page for every additional page," plus postage, shipping, and sales tax. The patient copy rule remained unchanged until the Board's 2008 amendment. The 2008 rule provided that individuals to whom HIPAA does not apply "shall pay for the reasonable cost of obtaining a copy of [the patient's] record, which shall be $16.50 for the first ten or fewer pages, $.75 for pages 11-40, and $.50 per page for every additional page," plus postage, shipping, and sales tax. The 2008 amendment also continued the 2001 fees for HIPAA-covered individuals (Le., patients and patients' personal representatives).
Because HIPAA was not in effect until 2003, the Board's 2001 rule amending the patient copy rule was not subject to HIPAA's rules regarding copying patient records. However, when HIPAA took effect in 2008, the portion of the 2001 rule that applies to HIPAA covered individuals-which the Board readopted in the 2008 rulemaking-was required to come into compliance with hHIPAA.
As stated, HIPAA regulations mandate that covered health care entities may only charge a "reasonable, cost-based fee" for providing copies of patient health records, and the fee may only include the cost of "copying, including the cost of supplies for and labor of copying." 45 CER. § 164.524(c)(4). Thus, to comply with HI-PAA, the portion of the patient copy rule that applies to HIPAA-covered individuals must be cost-based and must not include *530costs beyond supplies for and labor of copying, as evidenced by the administrative record. Id.; see § 24-4-108(4)(a), C.R.S.2009 ("rules promulgated by the agency shall be based on the record, which shall consist of proposed rules, evidence, exhibits, and other matters presented or considered, matters officially noticed, rulings on exceptions, any findings of facts and conclusions of law proposed by any party, and any written comments or briefs filed"); see Citizens for Free Enterprise, 649 P.2d at 1064 (in the context of APA's "based on the record" requirement for agency rule, where rule's necessity turns on discrete facts capable of demonstrable proof as well as policy considerations, rule's reasonableness depends on the existing factual support for its determination as well as a defensible reasoning process).
2. Application
Here, neither CCHI nor the Board provided the trial court with undisputed facts demonstrating that it was legally entitled to summary judgment regarding the patient copy rule's compliance with HIPAA.
CCHI's summary judgment motion simply recited, without supporting documents, a list of "undisputed facts." Although CCHI asserted that the administrative records would be provided to support its motion, they never were. Thus, CCHI did not present undisputed facts showing the patient copy rule fees for HIPAA-covered individuals were not cost-based or included ancillary costs. Accordingly, CCHI did not demonstrate it was legally entitled to judgment on this issue. See Johnson v. Colorado State Bd. of Agriculture, 15 P.3d 309, 311 (Colo.App.2000) (summary judgment only appropriate where all relevant facts are undisputed).
To support its summary judgment motion, the Board provided the trial court copies of the 2001 patient copy rule, the 2008 patient copy rule, AHIOS's 2007 proposed amendment to the patient copy rule (which the Board adopted in 2008), and an affidavit. However, because the affidavit was taken after the Board adopted the 2001 and 2008 rules, it could not have been a basis for the rule. See § 24-4-108(4)(a) ("rules promulgated by the agency shall be based on the record"). The 2001 and 2008 patient copy rules also did not support the Board's motion because they do not indicate that the copy fees for HIPAA-covered individuals were cost-based and excluded ancillary costs.
Thus, the Board's entitlement to summary judgment turned on whether AHIOS's 2007 proposed amendment demonstrated that the portion of the rules that apply to HIPAA-covered individuals was cost-based and excluded ancillary costs. However, the proposed amendment only included a single reference to HIPAA-covered individuals: "The current rate shall not change for the purpose of the patient and or the patient's personal representative as defined by HIPAA." Thus, the proposed amendment did not show that the copy fees charged to HIPAA-covered persons were cost-based and excluded ancillary costs. Therefore, the Board did not demonstrate that it was legally entitled to judgment on the issue of HIPAA compliance. See Johnson, 15 P.3d at 311 (summary judgment only proper where undisputed facts demonstrate that movant is legally entitled to judgment).
Accordingly, the trial court did not err in denying CCHI's summary judgment motion regarding the patient copy rule's compliance with HIPAA, but erred in granting the Board's motion on this issue.
B. Compliance with Colorado Law
CCHI also contends that the trial court erred in entering summary judgment for the Board and against CCHI on the issue of the patient copy rule's compliance with Colorado law. We conclude that neither party was entitled to summary judgment on this issue.
As noted, we review de novo the trial court's legal conclusions, including statutory interpretation, and we give appropriate deference to the Board's interpretation of a statute it is charged with administering unless the interpretations are inconsistent with the statute's clear language or legislative intent. See Esser, 30 P.3d at 194; Meridian Ranch Metropolitan Dist., 240 P.3d at 387; Besch v. Jefferson County Bd. of County Comm'rs, 20 P.3d 1195, 1196 (Colo.App.2000).
*5311. Legal Principles and Arguments
Colorado law provides that health care facilities must furnish copies of medical records to the patient "upon the payment of the reasonable costs." § 25-1-801(1)(b)(I), C.R.S. 2009. Similarly, individual health care providers must make copies available to patients and their designated representatives "upon reasonable notice and payment of the reasonable costs." § 25-1-802(1)(b)(I), C.R.8.2009. Because the General Assembly used the phrase "payment of the reasonable costs," the statutes' plain language only authorizes health care facilities and individual providers to charge patients (and their designated representatives, in the case of individual health care providers) for the reasonable costs of providing the copies. See Denver Post Corp. v. Ritter, 230 P.3d 1238 (Colo.App.2009) (cert. granted May 17, 2010) (it is a fundamental statutory construction rule to give effect to every word of a statute); see also Davison v. Indus. Claim Appeals Office, 84 P.3d 1023, 1029 (Colo.2004) (where possible, courts must construe statutes based on plain language).
CCHI, however, contends that "the reasonable costs" may not include the costs of ancillary services involved in providing the copies, such as record retrieval, processing, record reassembling, and invoicing. Specifically, CCHI argues: (1) because the statutes provide that patients or their representatives may obtain copies upon payment of "the reasonable costs" and not upon "multiple reasonable costs," the amount charged may not include costs beyond the supplies and labor of copying; (2) the statutes' free-inspection provisions bar health care facilities and providers from charging for costs inherent in inspection; and (8) Colorado law mandates that patients and their designated representatives be subject to the same charges. We reject each argument in turn.
First, although the statutes authorize health care facilities and providers to charge for "the reasonable costs" of providing copies, we reject CCHI's argument that "the" indicates that health care facilities and providers may only charge for the singular costs directly incurred in the physical act of copying. The terms "costs" is not singular, and the statutes do not limit the "costs" to the costs of supplies and the labor of copying. See Dubois v. Abrahamson, 214 P.3d 586, 588 (Colo.App.2009) (court will not read into statute a limitation the plain language does not suggest).
Second, we reject CCHI's argument that, because sections 25-1-801(1)(a) and 25-1-802(1)(a), C.R.S.2009, entitle patients and their representatives to inspect their medical records without charge, charging for the costs inherent in such inspection is necessarily not a "reasonable cost." Neither the inspection provisions nor the copying provisions state that the costs inherent in record inspection cannot be charged as part of the "reasonable costs" charged for providing copies. See Mason v. People, 932 P.2d 1377, 1380 (Colo.1997) (courts presume that if General Assembly intended the statute to achieve a particular result, it would have employed terminology clearly expressing that intent).
Third, we reject CCHI's argument that Colorado law mandates that patients and their designated representatives be subject to the same charges. Section 25-1-802(1)(b)(I) simply states that a "copy of such [medical] records ... shall be made available to the patient or the patient's designated representative, upon ... payment of the reasonable costs." As discussed, health care facilities and providers may only charge patients for the reasonable costs of providing the copies. See Davison, 84 P.3d at 1029 (courts construe statutes based on plain language). That is true for both patients and their designated representatives. See id. However, HIPAA further limits the costs charged to patients to only the costs of supplies and the labor for copying. 45 C.F.R. § 164.524(c)(4). Nothing in HIPAA, its related regulations, or Colorado law states that the additional HIPAA limitations for patients also apply to their designated representatives. See Dubois, 214 P.3d at 588 (court will not read into statute a limitation the plain language does not suggest).
2. Application
Here, neither CCHI nor the Board provided the trial court with undisputed facts *532demonstrating that it was legally entitled to summary judgment regarding the patient copy rule's compliance with Colorado law.
As discussed, the administrative records for the 2001 and 2008 rulemakings were never provided to the trial court. Thus, CCHI failed to present undisputed facts showing that the fees set forth in the 2001 and 2008 patient copy rules did not reflect the reasonable costs of providing copies. Accordingly, CCHI did not demonstrate it was legally entitled to judgment on this issue. See Johnson, 15 P.3d at 311 (summary judgment only appropriate where all relevant facts are undisputed).
Also, as discussed, to support its summary judgment motion, the Board provided the trial court with the 2001 and 2008 patient copy rules, AHIOS's 2007 proposed amendment, and an affidavit Again, because the affidavit was not part of the administrative record, it could not have been the basis of the rules. See § 24-4-108(d4)(a) ("rules promulgated by the agency shall be based on the record"). The 2001 and 2008 patient copy rules also did not support the Board's summary judgment motion because they do not indicate that the copy fees reflect costs.
Thus, as discussed in part IILB.1, the Board's entitlement to summary judgment on the issue of compliance with Colorado law turned on whether AHIOS's 2007 proposed amendment demonstrates that the copy fees in the rules reflect the costs of providing copies. Sections 25-1-801(1)(b)(I's and 25-1-802(1)(b)(I)'s plain language only authorizes charging patients, and in the case of section 25-1-802(1)(b)(I) their designated representatives, for the reasonable costs of providing copies.
The 2007 proposed amendment stated that the copy fees charged to those not covered by HIPAA were selected simply by averaging the fees charged to attorneys and insurers in forty-two other states. The proposed amendment did not include data regarding the actual costs of providing copies in Colorado, nor did it indicate whether the other states' fees were based on the actual costs of providing copies in those states. It did not indicate whether the costs of providing copies in Colorado mirror the costs of providing copies in the other states, nor whether the other states' laws require the fees to reflect the costs of providing copies. It also did not include data on what fees other states charge to personal representatives who are not attorneys or insurers.
Thus, AHIOS's 2007 proposed amendment did not show that the patient copy rule's copy fees reflected the reasonable costs of providing copies. Therefore, the Board did not demonstrate that it was legally entitled to judgment on the issue of compliance with Colorado law. See Johnson, 15 P.3d at 311 (summary judgment only proper where undisputed facts demonstrate that movant is legally entitled to judgment).
Accordingly, the trial court did not err in denying CCHI's summary judgment motion on this issue, but erred in granting the Board's motion on this issue.
The court's order denying CCHI's summary judgment motion is affirmed, and its order granting the Board's summary judgment motion is reversed. The case is remanded for further proceedings as directed.
Judge TAUBMAN concurs. Judge FURMAN concurs in part and dissents in part.