Chilivis Grubman attorneys have written extensively about the HIPAA Right of Access Initiative by the U.S. Department of Health and Human Services (HHS) Office of Civil Rights (OCR), which was first announced in 2019. HIPAA rules allow patients (or designated representatives) to request copies of their health information. Once a covered entity receives a request, it has 30 days (absent an extension) to respond and provide the records to the requester. Since the Right to Access Initiative was announced, OCR has announced dozens of settlements to resolve allegations of violating HIPAA and patient rights to access medical records.
Right to Access investigations and settlements continue. On December 15, 2022, OCR issued a press release noting that Health Specialists of Central Florida, Inc. (the “Practice”) paid $20,000 and agreed to a corrective action plan to resolve allegations it violated HIPAA. In November 2019, the personal representative and daughter of a deceased patient filed a complaint with OCR alleging that the Practice did not timely provide medical records, despite multiple requests. Her first request was in August 2019, and she received the requested records nearly five months later. According to OCR, the records were provided after it initiated its investigation. According to the settlement agreement, the Practice did not admit liability.
OCR’s Right of Access Initiative will continue, and OCR is taking these cases seriously, as noted by OCR Director, Melanie Fontes Rainer, “[t]he right of patients to access their health information is one of the cornerstones of HIPAA, and one that OCR takes seriously. We will continue to ensure that health care providers and health plans take this right seriously and follow the law.” Covered entities should familiarize themselves with patients’ rights under HIPAA to access protected health information by reviewing the related statutes (45 C.F.R. § 165.524) and HHS guidance. Covered entities should also appreciate that there are several factors that OCR considers in its investigation and settlement discussions. These factors include the completeness of the records provided, the time between the medical records request and production of the records, whether the practice instituted limitations or barriers, and other factors that impede access to records. The way to request records, the charges associated with records requests, and the delivery/pickup requirements of records are all areas where covered entities can inadvertently create an overly burdensome process.
The attorneys at Chilivis Grubman assist businesses of all types and sizes in connection with HIPAA-related matters, including breach response, breach notification, OCR investigations, and resulting civil litigation. If you need assistance with such a matter, please contact us today.