OCR Continues Enforcement of its HIPAA Right of Access Initiative

The Department of Health and Human Services Office for Civil Rights (“OCR”) continues to bring enforcement actions against entities it alleges have infringed on a patient’s right to timely access their records in violation of the Health Insurance Portability and Accountability Act (“HIPAA”).

Since our last analysis of OCR’s HIPAA Right of Access Initiative in March 2021, OCR has announced three additional settlements. Of note, all three concerned an alleged delay by a medical practice to provide medical records to a patient or the patient’s authorized representative.

  • As a result of OCR’s seventeenth investigation, Arbour Hospital, a Massachusetts behavioral health center, agreed to pay a fine of $65,000 and enter into a corrective action plan as a result of Arbour’s alleged failure to timely respond to a patient’s request for records. It was alleged that the requestor submitted a request for records to Arbour on May 7, 2019, but failed that Arbour failed to respond. Thereafter, the requestor filed a complaint with OCR on July 5, 2019. OCR provided Arbour with technical assistance, but the requestor filed a second complaint on July 28, 2019, stating that he had not received his records. According to OCR’s investigation, the requestor did not receive his records until November 1, 2019.
  • As a result of OCR’s eighteenth investigation, a New Jersey based plastic surgery center agreed to pay a fine of $30,000 and enter into a corrective action plan as a result of the center’s alleged failure to timely respond to a patient’s request for records. It was alleged that the patient submitted a request for records to the center in August 2019, but that the center never responded to the request. Thereafter, the patient filed a complaint with OCR on September 7, 2019.
  • Similar to the settlements described above, as a result of OCR’s nineteenth investigation, a West Virginia based physician practice agreed to pay a fine of $5,000 and enter into a corrective action plan as a result of the practice’s alleged failure to timely respond to a parent’s request for access to their minor child’s medical records. It was alleged that the parent made the request for access to the child’s records in July 2019, but that the practice never responded to the request. Thereafter, the patient filed a complaint with OCR on August 6, 2019.

How Frier Levitt Can Help

As underscored by the settlements described above, each of which concerned conduct that took place in the summer of 2019, an investigation into an entity’s practices and a resulting settlement may occur years after a patient makes a complaint to OCR regarding their inability to access medical records. HIPAA governed entities must take note of OCR’s enforcement activities and ensure that they implement appropriate policies and procedures to timely respond to requests for records. Contact Frier Levitt for assistance with your practice’s HIPAA compliance. 

Tagged with: , , ,
Share: