In 2019, the U.S. Department of Health and Human Services’(HHS) Office of Civil Rights (OCR) announced its Right of Access Initiative and promised to “vigorously enforce” patients’ right to access their medical records. Under this initiative, OCR investigated and settled allegations involving medical practices that potentially violated the HIPAA Privacy Rule’s right of access requirements (45 C.F.R. § 164.524). In November 2020, Director Roger Severino commented on OCR’s HIPAA Right of Access Initiative, noting: “We will continue to prioritize HIPAA Right of Access cases for enforcement until providers get the message.”
OCR’s enforcement actions have been broad, affecting small practices and major healthcare systems. The monetary settlements have been equally broad, ranging from less than $5,000 to more than $150,000. Also, the frequency of settlements has been increasing. There were only two settlements in the last quarter of 2019. In 2020, OCR settled eleven enforcement actions under the Right of Access Initiative in the last quarter of 2020. CG attorneys have monitored and alerted readers to many of these settlements, including the tenth, eleventh, twelfth, and thirteenth settlements. CG attorneys cautioned readers to heed OCR’s warnings regarding a patient’s right to access their medical records and noted that heightened enforcement efforts under the Right of Access Initiative would likely continue. OCR did not disappoint.
On January 12, 2021, OCR announced its first settlement of 2021 (its fourteenth settlement overall) under the Right of Access Initiative. According to the press release, OCR received two complaints against Banner Health ACE. In the first complaint, a patient allegedly requested access to her records in December 2017 but did not receive the records until 5 months later. The second complaint had similar allegations. In the second complaint, the patient allegedly requested electronic copies of his records in September 2019, but the records were not sent until 5 months later in February 2020.
OCR opened an investigation and found that Banner Health ACE’s failure to provide timely access to medical records were potential violations of the HIPAA right of access requirements. Banner Health ACE agreed to pay $200,000 to settle the potential violations of the HIPAA Privacy Rule’s right of access standard. Banner Health ACE also entered into a corrective action plan that includes monitoring for two years.
OCR’s announcement is a clear message that its enforcement efforts will continue. According to Director Severino, “[t]his first resolution of the year signals that our Right of Access Initiative is still going strong and that providers of all sizes need to respect the right of patients to have timely access to their medical records.” Providers and medical practice administrators should familiarize themselves with patients’ rights under HIPAA to access protected health information by reviewing the related statutes (45 C.F.R. § 165.524) and HHS guidance.
The attorneys at Chilivis Grubman assist businesses of all types and sizes in connection with HIPAA related matters, including breach response, breach notification, OCR investigations, and resulting civil litigation. If you need assistance with such a matter, please contact us today.