The Department of Health and Human Services’ Office for Civil Rights (OCR) has recently agreed to settle five HIPAA compliance cases that were investigated after individuals were denied access to their health information.
The HIPAA Privacy Rule gave individuals the right to obtain a copy of their health records from their providers, health insurer, and business associates of those entities. Access must be provided quickly and no later than 30 days, and only a reasonable cost-based fee can be charged for providing access to those records.
After uncovering many cases where this right was not being honored, OCR launched a HIPAA Right of Access initiative in 2019 and made patient access rights one of its top enforcement priorities. Last year, OCR issued a financial penalty of $85,000 to Bayfront Health St Petersburg and Korunda Medical under the HIPAA Right of Access initiative. A further fine settlements have now been reached, with the penalties ranging from $3,500-$70,000.
OCR Director Roger Severino said: “Patients can’t take charge of their health care decisions, without timely access to their own medical information. Today’s announcement is about empowering patients and holding health care providers accountable for failing to take their HIPAA obligations seriously enough.”
Beth Israel Lahey Health Behavioral Services
In April 2019, OCR received a complaint about Beth Israel Lahey Health Behavioral Services (BILHBS) not processing a request from a patient for a copy of her father’s medical records. The complainant asked for the records in February 2019, but they had still not been handed over two months later. The patient finally obtained the records in October 2019. OCR ruled that there had potentially been a violation of the HIPAA Right of Access and agree to settle the case for $70,000.
Housing Works
Housing Works is a New York City based non-profit healthcare group that provides healthcare, homeless services, advocacy, job training, re-entry services, and legal aid guidance for people living with and affected by HIV/AIDS. A patient requested a copy of his medical records in June 2019 . In July 2019 he filed a complaint with OCR which found that the HIPAA Right of Access had been violated. The case was settled for $38,000.
All Inclusive Medical Services, Inc.
Located in Carmichael, California, All Inclusive Medical Services, Inc. (AIMS) is a multi-specialty family medicine clinic that supplies a variety of treatments including internal medicine, pain management, and rehabilitation.
In January 2018, a patient asked for medical records, but AIMS refused to provide a copy. The patient filed a complaint with OCR in April 2018 and an investigation was launched. OCR determined the failure to permit the patient to inspect and receive a copy of her medical records was in breach of the HIPAA right of access. The patient was given access to her records in August 2020. OCR ordered AIMS to pay $15,000 to settle the case.
King MD
Located in Virginia, King MD is a small psychiatric service provider . OCR received a complaint in October 2018 from a patient who had not been given a copy of her medical records within two months of submitting a request for a copy. OCR contacted King MD and provided technical guidance on the HIPAA right of access; however, in February 2019, OCR received a second complaint as King MD had still not handed over the medical records. Those records were finally provided in July 2020. The case was settled for $3,500.
In all cases, the covered entity was required to adopt a corrective action plan in addition to paying the fine. each entity will also be monitored by OCR for compliance for between 1 and 2 years.