The Department of Health and Human Services Office for Civil Rights (“OCR”) continues to bring enforcement actions against entities it alleges have infringed on a patient’s right to timely access their records in violation of the Health Insurance Portability and Accountability Act (“HIPAA”).
As previously discussed by Frier Levitt, in September 2019, OCR settled its first case under the Right of Access Initiative. In that initial settlement, a hospital agreed to pay $85,000 and enter into a corrective action plan, including OCR monitoring, due to the hospital’s multi-month delay in providing a mother with her child’s fetal heart monitor records.
Since September 2019, OCR has announced sixteen total investigations under its Right of Access Initiative. These investigations and corresponding settlements have targeted a variety of providers and facilities, from small private practitioners to large academic medical centers. Some of the recent settlements are highlighted below:
- Sharp Healthcare, a San Diego-based health system, paid $70,000 and entered into a corrective action plan as a result of Sharp’s failure to provide a patient with a copy of his electronic health records for seven months after the patient first made the request. The request for records was first made in April 2019. Having not received the records, the patient then filed a complaint with OCR in June 2019 and again in August 2019.
- Renown Health, a health system in Nevada, paid $75,000 and entered into a corrective action plan as a result of Renown’s twelve-month delay in providing electronic medical records to a patient’s attorney at the patient’s request.
- Banner Health, a health system in Arizona, paid $200,000 and entered a corrective action plan as a result of Banner’s delay in providing medical records. OCR received two complaints from patient attorneys describing a multi-month delay in receiving records.
- Elite Primary Care, a private practice, paid $36,000 and entered a corrective action plan as a result of a nearly one-year-long delay in providing a patient with their medical records In response to a patient complaint, OCR provided the practice with technical assistance in May 2019. Nevertheless, the practice did not respond to the patient’s request for records, and as such, the patient again filed a complaint in October 2019. The practice provided the records to the patient in May 2020.
- University of Cincinnati Medical Center paid $65,000 and entered a corrective action plan due to a six-month delay in providing medical records to a patient’s attorney, which came to the OCR’s attention as a result of a complaint being filed two months after the record request.
- An otolaryngologist in private practice paid $15,000 and entered a corrective action plan due to a nearly two-year delay in providing a patient with access to her medical records.
- New York Spine Medicine, a neurology and pain management practice with offices in New York and Florida, paid $100,000 and entered a corrective action, as a result of the practice’s nearly one-year delay in providing a patient with her records despite repeated requests by the patient, and repeated failures by the practice to respond to OCR inquiries.
Several of the investigations described above resulted from complaints filed with OCR by attorneys representing the affected patients. While unaddressed requests made by a patients’ counsel may have a higher likelihood of resulting in a complaint being filed with OCR, patients themselves can and often do escalate disputes to OCR. Regardless of source, covered entities and their business associates must ensure that all record requests are responded to in a timely manner.
How Frier Levitt Can Help
From OCR’s Right of Access Initiative to information blocking prohibitions, there is a clear trend to enhance patients’ access to their data in a timely and uncomplicated manner. Covered entities and their business associates should take notice of OCR’s aggressive enforcement activities and ensure that they implement appropriate policies and procedures to avoid costly penalties and tedious corrective action plans. In addition, employees handling patient requests must be effectively trained as to the requirements for responding to medical record requests. Contact Frier Levitt for a review of your current HIPAA policies or for assistance with developing compliant procedures for your practice or facility.
