Chilivis Grubman attorneys have written extensively about the HIPAA Right of Access Initiative by the U.S. Department of Health and Human Services (HHS) Office of Civil Rights (OCR), which was first announced in 2019. Under the initiative, OCR has communicated its intent and commitment to vigorously enforce the HIPAA rules that allow patients to access their protected health information, as delineated in 45 C.F.R. § 165.524. HIPAA rules allow patients (or designated representatives) to request copies of their health information. Once a covered entity receives a request, it has 30 days (absent an extension) to respond to provide the records to the requester.
Since 2019, there have been dozens of settlements. Chilivis Grubman has cautioned that OCR’s Right of Access Initiative was not limited to large medical practices. OCR’s enforcement efforts and related monetary settlements have been broad and wide-reaching, affecting covered entities of all sizes, and have not been limited to medical practices. In April 2022, OCR announced one of its first settlements involving a dental practice. OCR has constantly cautioned providers that it will continue to aggressively investigate complaints related to patients accessing their records.
On July 15, 2022, OCR announced eleven enforcement actions as part of its Right of Access Initiative. The eleven settlements involve small medical practices, large healthcare institutions, dental practices, and a not-for-profit health system. The violations include (1) failure to timely provide a patient with a copy of their medical records; (2) failure to provide a complete copy of requested medical records; and (3) failure to provide a patient’s personal representative with timely access to medical records. The eleven enforcement actions resulted in over $645,000 in settlements. While the eleven settlements involve failure to provide a patient or personal representative with timely access to records, covered entities can also run afoul of HIPAA requirements by instituting an overly burdensome process for patient records to be disclosed. The manner to request records, the charges associated with records requests, and delivery/pickup requirements of records are all areas where covered entities can inadvertently create an overly burdensome process.
With OCR’s most recent announcement, the total enforcement actions stemming from OCR’s Right of Access Initiative is now thirty-eight, and there are no signs that OCR will reduce the priority of its Right of Access Initiative. OCR Director Lisa J. Pino warned: “Health care organizations should take note that there are now 38 enforcement actions in our Right of Access Initiative and understand that OCR is serious about upholding the law and peoples’ fundamental right to timely access to their medical records.” OCR’s Right of Access Initiative will continue and covered entities should familiarize themselves with patients’ rights under HIPAA to access protected health information by reviewing the related statutes (45 C.F.R. § 165.524) and HHS guidance.
The attorneys at Chilivis Grubman assist businesses of all types and sizes in connection with HIPAA-related matters, including breach response, breach notification, OCR investigations, and resulting civil litigation. If you need assistance with such a matter, please contact us today.