OCR Announces Resolution of More HIPAA Right of Access Initiative Cases
On July 15, 2022, the Office for Civil Rights (OCR) announced that it has resolved eleven more investigations in its Right of Access Initiative. This initiative, which began in 2019, enforces the patient right of access to health records under the Health Insurance Portability and Accountability Act (HIPAA). Thirty-eight investigations have been completed under this program.
The Right of Access investigations have involved many types of providers. The most recent announcement includes:
- A civil money penalty of $100,000 imposed on a podiatry practice that failed to provide a former patient with requested medical records, and ignored data requests from OCR.
- A settlement of $3,500 with a psychiatry practice that withheld access to the patient’s record because the patient had an outstanding balance.
- A settlement of $55,000 with a health care provider which did not provide a personal representative with timely access to medical records, mistakenly believing that the power of attorney did not allow for access.
- A settlement of $240,000 with a health system for failing to timely respond to an access request.
The HIPAA Privacy Rule generally requires that a health care provider respond within thirty days to a request for access to health records from the patient or personal representative. This applies to both medical records and billing records. All health care providers should make sure their procedures for requesting records do not impose barriers that are not permitted under the Privacy Rule, and that they record when the patient or representative requests the record and how long it takes to respond.