OCR Right of Access Initiative Heats up

More and more healthcare providers who fail to make it easy for patients to access their medical records are finding themselves in hot water with the HHS Office of Civil Rights. In just the last few weeks, OCR announced it had settled two more investigations into violations of the HIPAA requirement that patients be given access to their electronic medical records in a timely manner and at a reasonable cost. That brings to nine the number of cases settled thus far.

Last year, OCR launched its Right of Access Initiative in an effort to “put patients in the driver’s seat.†In September, OCR announced it had settled five such cases.

In its eighth case, Dignity Health, doing business as St. Joseph’s Hospital and Medical Center agreed to take corrective actions and pay $160,000 to settle a potential violation. The Phoenix, Arizona-based acute care hospital, with several hospital-based clinics, was alleged to have failed to provide a mother with her son’s medical records following multiple requests.

OCR initiated its investigation after the April 2018 complaint. It wasn’t until December 2019 – 22 months after the initial records request – that the hospital complied. In addition to the monetary settlement, the hospital agreed to undertake a corrective action plan that includes two years of monitoring.

In its ninth case, NY Spine Medicine agreed to take corrective actions and pay $100,000 to settle a potential violation. NY Spine is a private medical practice specializing in neurology and pain management with offices in New York and Miami Beach.

OCR received a complaint in July 2019 from a patient who said she made multiple requests for her medical records. While NY Spine Medicine provided some of the records, it did not provide the diagnostic films that the individual specifically requested. As a result of OCR’s investigation, the complainant received all of the requested medical records in October 2020.

As in the earlier case, in addition to the monetary settlement, NY Spine will undertake a corrective action plan that includes two years of monitoring.

OCR noted in a news release that it has many right of access investigations open across the country, “and will continue to vigorously enforce this right to better empower patients.â€

It’s important to note that neither settlement constitute any admission of guilt on the part of the healthcare providers who settled.

As previously noted, OCR considers a number of different factors when determining the amount of a settlement including: the nature and extent of the potential HIPAA violation; the nature and extent of the harm resulting from the potential HIPAA violation; the entity’s history with respect to compliance with the HIPAA rules; the financial condition of the entity, including its size; and the impact of the COVID-19 public health emergency.

The earlier settlements ranged from $3,500 to as much as $70,000. These more recent agreements are significantly higher.

OCR has made it clear it will continue to enforce this Right of Access Initiative.

“HIPAA entitles patients to timely access to their records and we will continue our stepped up enforcement of the right of access until covered entities get the message,†OCR Director Roger Severino, stated in a news release.

In light of the stepped up enforcement actions, providers should review their policies and practices to ensure that they respond to patient requests for access to medical records in compliance with HIPAA rules. Our attorneys are well qualified to assist you in this matter. Contact us for additional information at 305-358-4500 or send us an email to info@vitalehealthlaw.com and let’s discuss how we might be able to assist you.