The 10th financial penalty under its HIPAA Right of Access enforcement initiative has been revealed by the U.S. Department of Health and Human Services’ Office for Civil Rights.
California-based Riverside Psychiatric Medical Group has committed to paying a financial penalty of $25,000 to settle a possible HIPAA Right of Access breach and will implement a corrective action plan to see to it that compliance with this provision of the HIPAA Privacy Rule is in place. The HHS will review Riverside Psychiatric Medical Group for the coming two years to ensure ongoing compliance.
OCR kicked off an investigation after the receipt of a complaint from a patient in March 2019 claiming that Riverside Psychiatric Medical Group did not supply her with a copy of her medical records after she had made a number of requests for tem, with the first request submitted during February 2019.
OCR got in touch with Riverside Psychiatric Medical Group and supplied technical assistance on how the practice could adhere with the HIPAA Right of Access and the case was shut. A month later, in April 2019, a second complaint was submitted from the patient saying she had still not been supplied with her medical records, despite OCR’s action.
OCR initiated the investigation and found that the Riverside Psychiatric Medical Group may have breached the HIPAA Right of Access after not taking any action. Riverside Psychiatric Medical Group explained that the request for records incorporated psychotherapy notes and, as such, the practice was not required to adhere.
OCR Director Roger Severino in a statement about the settlement: “When patients request copies of their health records, they must be given a timely response, not a run-around”.
OCR surmised that psychotherapy notes do not need to be given to patients; however, in cases when requests are registered, requestors must be given a written explanation as to why the requested records will not be handed over, either in total or in part and access should be provided to parts of medical records that do not include psychotherapy notes. Riverside Psychiatric Medical Group had not contacted the patient to explain why the request had been turned down.
Following the second OCR intervention, the patient was given a copy of her medical records in October 2019, as requested, without the psychotherapy notes.