OCR Settles With Five Providers Over HIPAA Right of Access Claims

The HHS Office of Civil Rights (OCR) recently announced the settlement of five more investigations into violations of the HIPAA requirement that patients be given access to their electronic medical records in a timely manner and at a reasonable cost.

As we first wrote about last year, OCR launched its Right of Access Initiative in an effort to “put patients in the driver’s seat,†by giving them easier access to their medical records so they can take control of decisions regarding their health. HIPAA rules generally require medical records be provided within 30 days of the request and that providers charge a reasonable cost-based fee.

The settlements range from $3,500 to as much as $70,000. In three of the five cases, the healthcare entities were told by OCR how to provide technical assistance to patients who requested their medical records, but then still did not comply until OCR stepped in a second time.

OCR considers a number of different factors when determining the amount of a settlement including: the nature and extent of the potential HIPAA violation; the nature and extent of the harm resulting from the potential HIPAA violation; the entity’s history with respect to compliance with the HIPAA rules; the financial condition of the entity, including its size; and the impact of the COVID-19 public health emergency.

The five healthcare entities are:

Housing Works, a New York City based non-profit organization that provides services and support to people living with and affected by HIV/AIDS, agreed to pay $38,000 to OCR and to adopt a corrective action plan.

In July 2019, OCR received a complaint alleging that, in June 2019, Housing Works failed to provide the complainant with a copy of his medical records. OCR provided Housing Works with technical assistance on the HIPAA Right of Access requirements and closed the complaint. In August 2019, OCR received a second complaint alleging that Housing Works still had not complied. OCR initiated an investigation and determined that Housing Work’s failure to provide the requested medical records was a potential violation of the HIPAA right of access standard. The complainant received his medical records in November 2019.

All Inclusive Medical Services, Inc. (AIMS), a Carmichael, California multispecialty family medicine clinic, agreed to pay $15,000 to OCR and to adopt a corrective action plan.

In April 2018, OCR received a complaint alleging that in January 2018, AIMS refused to give a patient access to her medical records when it denied her requests to inspect and receive a copy of her records. OCR initiated an investigation and determined that AIMS’s actions were potential violations of the HIPAA right of access standard. AIMS sent the patient her medical records in August 2020.

Beth Israel Lahey Health Behavioral Services (BILHBS), a network of mental health and substance use disorder services in eastern Massachusetts, agreed to pay $70,000 to OCR and to adopt a corrective action plan.

In April 2019, OCR received a complaint alleging that BILHBS failed to respond to a February 2019 request from a personal representative seeking access to her father’s medical records. OCR initiated an investigation and determined that BILHBS’ failure to provide the requested medical records was a potential violation of the HIPAA right of access standard. BILHBS sent the personal representative the requested medical records in October 2019.

King MD, a small psychiatric services provider in Virginia, agreed to pay $3,500 to OCR and to adopt a corrective action plan.

In October 2018, OCR received a complaint alleging that King MD failed to respond to an individual’s August 2018 request for access to her medical records. OCR provided King MD with technical assistance on the HIPAA right of access requirements and closed that complaint. In February 2019, OCR received a second complaint alleging that the practice still had not complied. OCR initiated an investigation and determined that the practice’s failure to provide the requested medical records was a potential violation of the HIPAA right of access standard. King MD sent the individual her medical records in July 2020.

Wise Psychiatry, PC, a small provider of psychiatric services in Colorado, agreed to pay 10,000 to OCR and to adopt a corrective action plan.

In February 2018, OCR received a complaint alleging that Wise Psychiatry failed to provide a personal representative with access to his minor son’s medical records. The complainant requested access in November 2017. OCR provided Wise Psychiatry with technical assistance on the HIPAA right of access requirements and closed that complaint in April 2018. In October 2018, OCR received a second complaint alleging that Wise Psychiatry still had not complied. OCR initiated an investigation and determined that Wise Psychiatry’s failure to provide the requested medical records was a potential violation of the HIPAA right of access standard. Wise Psychiatry sent the personal representative his son’s medical records in May 2019.

These five settlement follow on the heels of two previous settlements last year. In September 2019, OCR announced its first enforcement action against Bayfront Health St. Petersburg, a Level II trauma and tertiary care center licensed as a 480-bed hospital.

In December 2019, OCR announced it’s second enforcement action against Korunda Medical LLC, a Naples, Florida-based company that provides comprehensive primary care and interventional pain management services.

OCR has made it clear that it will continue to vigorously enforce this Right of Access Initiative. Healthcare practices would be well-advised to ensure they are in compliance and to provide patients with access to their medical records in a timely manner at a reasonable cost.

The Health Law Offices of Anthony C. Vitale can assist you in reviewing your policies and procedures. Contact us for additional information at 305-358-4500 or send us an email to info@vitalehealthlaw.com and let’s discuss how we might be able to assist you.