Pulmonology Coding Alert

Question: We had a patient ask for her medical records and we misplaced the request and forgot about it, unfortunately. After a month passed, she called us threatening legal action. Should we call an attorney?

Pennsylvania subscriber

Answer: First and foremost, apologize and let her know that you have her records ready for her, but if she still wants to make a case, then you may want to contact your health care attorney and ask for advice. The reality is that HIPAA requires covered entities (CEs) to provide their patients with their protected health information (PHI) within 30 days of a request. In addition, a nominal fee for the medical records is allowed, but it must be reasonable.

Although it isn’t common for lawsuits to spring from this situation, it has happened. On Sept. 9, Bayfront Health-St. Petersburg agreed to pay the HHS Office for Civil Rights (OCR) $85,000 to settle a HIPAA violation related to a patient’s right to access medical records, an OCR release indicates. The Florida-based medical center also committed to a one-year corrective action plan (CAP) to remedy its issue.

According to OCR, Bayfront didn’t comply and failed to give a pregnant mother records concerning her unborn child in a timely manner. The mother issued a complaint to the OCR, which precipitated an investigation by the agency. Bayfront did not get the mother the records until nine months after the initial request.

This is just an example of what could happen if you don’t comply with the law and shows the importance of taking medical record requests seriously.