CG Attorneys continue to monitor and provide updates regarding the HIPAA Right of Access Initiative by the U.S. Department of Health and Human Services’(HHS) Office of Civil Rights (OCR). Under the HIPAA Right of Access Initiative, OCR has made a determined effort to investigate claims that covered entities have violated patients’ right to access protected health information, as delineated in 45 C.F.R. § 165.524. As CG attorneys have noted in previous blog posts, OCR’s enforcement efforts and related monetary settlements have been broad and wide reaching, affecting covered entities of all sizes. Since 2019, when the HIPAA Right of Access Initiative was announced, OCR has settled fourteen enforcement actions. On February 10 and 16, 2021, OCR announced its fifteenth and sixteenth Right of Access Initiative settlements.
OCR’s Fifteenth Right of Access Initiative Settlement
In February 2019, OCR received a complaint alleging that Renown Health did not timely respond to a patient’s request for an electronic copy of her medical records, including billing records, to be sent to a third party. OCR initiated an investigation and Renown Health provided the patient access to the requested records in late December 2019, nearly a year after the initial request for records was made. OCR determined that Renown Health potentially violated the HIPAA Right of Access requirements.
This case appears to have differed somewhat from the typical trajectory. In many of the HIPAA Right of Access Initiative settlements, OCR initially provides technical assistance and does not initiate a formal investigation until there is a second complaint against the covered entity related to that technical assistance. For Renown Health, however, neither the press release nor corrective action plan indicate whether a second complaint was made before OCR’s investigation and Renown Health’s settlement. Under the settlement agreement, Renown Health agreed to pay $75,000 and undertake a corrective action plan with monitoring for two years. A copy of the agreement is available here.
OCR’s Sixteenth Right of Access Initiative Settlement
In June 2019, OCR received a complaint alleging that Sharp Rees-Stealy Medical Centers (“SRMC”) did not timely respond to a patient’s request for medical records to be sent to a third party. OCR provided technical assistance and reminded SRMC of the HIPAA Right of Access requirements. As with most right of access enforcement actions, OCR received a second complaint in August 2019 alleging that SRMC had not responded to the patient’s request for records, despite the technical assistance. OCR then initiated a formal investigation and determined that SRMC may have violated the right of access requirements. After OCR initiated its investigation, SRMC finally provided access to the requested records. SRMC agreed to pay $70,000 to settle the potential violation of HIPAA Right of Access requirements. SRMC also agreed to a corrective action plan that includes monitoring for two years. A copy of the agreement is available here.
Six weeks into 2021, and already there have been three published HIPAA Right of Access Initiative settlements totaling nearly $350,000. These enforcement actions are likely to continue. According to acting OCR Director Robinsue Frohboese, “[p]atients are entitled to timely access to their medical records. OCR created the Right of Access Initiative to enforce and support this critical right.” Patients’ rights under HIPAA to access protected health information are located at 45 C.F.R. § 165.524 and HHS as provided guidance. CG attorneys’ previous posts about the tenth, eleventh, twelfth, thirteenth, fourteenth settlements, and other HIPAA related matters are available here.
The attorneys at Chilivis Grubman assist businesses of all types and sizes in connection with HIPAA related matters, including breach response, breach notification, OCR investigations, and resulting civil litigation. If you need assistance with such a matter, please contact us today.