Health Information Compliance Alert

During the pandemic, HHS Office for Civil Rights (OCR) enforcement has been relatively quiet, with one exception — HIPAA Right of Access enforcement. Five recent settlements bring the total amount to 25 cases in two years.

Since OCR announced its Right of Access Initiative in September 2019, the agency has been on a campaign to ensure patients’ timely access to their records. In fact, the majority of OCR’s enforcement actions since the COVID-19 public health emergency (PHE) have been for HIPAA Right of Access-related violations.

Now: On Nov. 30, OCR announced five new settlements ranging from $10,000 to $160,000 for Right of Access violations. The cases showcase OCR’s continued willingness to bring penalties against both small, sole providers and large organizations.

Here’s the breakdown of the five Right of Access settlements from smallest to largest:

• Raleigh, North Carolina-based Wake Health Medical Group, a primary care provider, agreed to pay OCR $10,000 to settle a complaint by a patient, who paid $25 for her records on June 27, 2019 and never received them. Wake Health must take corrective actions to improve its access issues. According to the resolution, the patient had not yet received her protected health information (PHI).
• Denver Retina Center (DRC) agreed to pay OCR $30,000 to settle a patient’s ignored request of records in 2018. The Denver-based provider of ophthalmological services entered into a corrective action plan (CAP) that includes one year of OCR monitoring.
• Advanced Spine & Pain Management (ASPM), operating in Cincinnati and Springboro, Ohio, offers chronic pain services to its patients. ASPM settled a potential November 2019 violation for $32,150 with OCR; the complainant did not receive his PHI until March 19, 2020. The firm will adhere to a CAP and two years of OCR monitioring.
• Internist and cardiovascular physician Robert Glaser, MD, from New Hyde Park, New York “did not cooperate with OCR’s investigation or respond to OCR’s data requests after failing to provide a patient with a copy of their medical record,” the agency release says. “Dr. Glaser waived his right to a hearing and did not contest the findings of OCR’s Notice of Proposed Determination.” Glaser paid OCR a civil monetary penalty (CMP) of $100,000 to settle the case.
• The Eugene, Oregon-based eating disorder treatment center, Rainrock Treatment Center, LLC dba Monte Nido Rainrock, settled a potential violation for $160,000 after a patient made two requests for records on Oct. 1, 2019 and Nov. 21, 2019, but didn’t receive the PHI until May 22, 2020. Monte Nido also agreed to a CAP and one year of OCR monitoring as part of its settlement.

Reminder: Once a covered entity (CE) receives a request from a patient for a copy of their PHI, the CE has 30 days to fulfill that request.

“Timely access to your health records is a powerful tool in staying healthy, patient privacy and it is your right under law,” notes OCR Director Lisa J. Pino in a release on the cases. “OCR will continue its enforcement actions by holding covered entities responsible for their HIPAA compliance and pursue civil money penalties for violations that are not addressed.”

Find more information about the five settlements, resolutions, and CAPs at www.hhs.gov/about/news/2021/11/30/five-enforcement-actions-hold-healthcare-providers-accountable-for-hipaa-right-of-access.html.