Health Information Compliance Alert

See details on 5 HIPAA Right of Access settlements.

In 2019, the HHS Office for Civil Rights (OCR) promised to make patients’ rights to their records a priority with its Right of Access Initiative. And though COVID-19 put a kink in OCR’s plans, the agency made good on its pledge of ramping up enforcement.

Now: On Sept. 15, OCR announced five new settlements under its Right of Access Initiative, bringing the total cases to seven. The program charges that patients deserve the “timely access to their health records at a reasonable cost under the HIPAA Privacy Rule,” reminds an OCR brief.

Reminder: “A HIPAA covered entity must respond to a patient’s request for access to records within 30 days of receiving the request. HIPAA permits covered entities to charge patients a reasonable fee for such access, unless otherwise prohibited by applicable state law,” explains attorney Ada Kozicz with Rivkin Radler LLP in online analysis.

Here’s a short breakdown of the five OCR cases:

Housing Works, Inc.: New York City-based Housing Works will pay OCR $38,000 and enter into a corrective action plan (CAP) for failing to hand over a complainant’s files in July 2019. The patient received the records in November 2019.

All Inclusive Medical Services, Inc.: AIMS in Carmichael, California, negotiated a $15,000 settlement with OCR as well that the firm had refused to fulfill her request for a copy of her records. It took two more years, but the patient finally received her information in August 2020.

Beth Israel Lahey Health Behavioral Services: Massachusetts-based BILHBS agreed to a CAP and a $70,000 payment to OCR for violating the right of access provision. A woman tried to obtain her father’s medical records from the organization in February 2019 — OCR’s investigation helped her finally get them in October 2019.

King MD: The small Virginia psychiatric services provider King MD agreed to pay OCR $3,500 and enter into a CAP over an individual’s August 2018 ignored request for her records. The investigation led to the woman receiving her data in July 2020.

Wise Psychiatry, PC: Colorado firm, Wise Psychiatry, will pay OCR $10,000 to settle the case as well as adopt a CAP. A father tried to obtain his son’s medical records in November 2017 and filed a complaint with OCR in 2018. “As a result of OCR’s investigation, Wise Psychiatry sent the personal representative his son’s medical records in May 2019,” notes the agency release.

“Patients can’t take charge of their health care decisions without timely access to their own medical information,” said OCR Director Roger Severino in a release on the settlements. “Today’s announcement is about empowering patients and holding healthcare providers accountable for failing to take their HIPAA obligations seriously enough,” Severino indicated.

Read the OCR brief, including links to all five settlements’ CAPs at: www.hhs.gov/about/news/2020/09/15/ocr-settles-five-more-investigations-in-hipaa-right-of-access-initiative.html.