Over the past year, CG attorneys have alerted readers about the focus of U.S. Department of Health and Human Services’(HHS) Office of Civil Rights (OCR) on patient access to records in its “HIPAA Right of Access Initiative.”  Under this initiative, OCR announced at least ten settlements involving medical practices that allegedly violated HIPAA’s record access requirements.  

The HIPAA Privacy Rule generally requires covered entities to provide individuals access to their “designated record sets” maintained by or for the covered entity.  The access requirements generally do not apply to (1) information not considered “designated record sets,” as defined by 45 C.F.R § 164.501, (2) psychotherapy notes, and (3) records created in reasonable anticipation of or for a civil, criminal, or administrative action. 45 C.F.R. § 164.524.

On November 6, 2020, HHS announced a $25,000 settlement involving Riverside Psychiatric Medical Group (“RPMG”).  OCR’s investigation was initiated after it received a complaint from an RPMG patient in March 2019.  The patient alleged that RPMG did not provide a copy of her medical records despite multiple requests the month prior.  OCR provided RPMG technical assistance regarding complying with the HIPAA record access requirements and closed its investigation.  The following month, OCR received a second complaint, which alleged that RPMG had yet to provide requested records.  During OCR’s investigation, RPMG asserted that it did not have to comply with the request, as the requested records contained psychotherapy notes.  However, OCR noted that RPMG had to provide medical records that did not contain psychotherapy notes and that were not created in anticipation of or for civil, criminal, or administrative actions.  RPMG was also required to provide a written explanation for denying the request – even if the denial was a partial denial.

Between September and October 2020, OCR settled seven enforcement actions as part of its HIPAA Right of Access initiative.  The settlements ranged from $3,500 to over $150,000 and included corrective action plans.  Providers and medical practice administrators should familiarize themselves with patients’ rights under HIPAA to access protected health information by reviewing the related statutes (45 C.F.R. § 165.524) and HHS guidance.  Enforcement actions will continue.  Last month, Roger Severino, OCR Director, stated that “HIPAA entitles patients to timely access to their records and [OCR] will continue our stepped-up enforcement of the right of access until covered entities get the message.”

The attorneys at Chilivis Grubman assist businesses of all types and sizes in connection with HIPAA related matters, including breach response, breach notification, OCR investigations, and resulting civil litigation.  If you need assistance with such a matter, please contact us today.