The Department of Health and Human Services’ Office for Civil Rights reported five settlements that resolved HIPAA violations related to patient complaints on getting a copy of their medical records.
The HIPAA Privacy Rule states that individuals have the right to get prompt access to their medical records at a reasonable price. When a person submits a request to obtain a copy of his/her medical records, a healthcare service provider should give those records with no reasonable delay and within 30 days following the date of request.
OCR received several complaints from people who were unable to obtain a copy of their medical records, so in 2019, OCR prioritized its HIPAA right of access enforcement activities.
In 2019, there were two settlements between HIPAA covered entities and OCR over HIPAA right of access violations. Korunda Medical, LLC and Bayfront Health St Petersburg each paid $85,000 as a financial penalty and implemented a corrective action plan to process access requests promptly.
The most recent 5 settlements involved Housing Works, Inc., Beth Israel Lahey Health Behavioral Services, King MD, All Inclusive Medical Services, Inc., and Wise Psychiatry, PC. The entities paid financial penalties ranging from $3,500 to $70,000 depending on a number of factors determined by OCR.
OCR is sending a message to healthcare providers by means of the settlements that compliance with the HIPAA right of access is a must. Whenever OCR receives complaints alleging non-compliance, investigations will be conducted and entities will be penalized as deemed appropriate.
Housing Works
Housing Works, Inc. is a non-profit healthcare organization based in New York City that offers healthcare, advocacy, job training, homeless services, re-entry services, and legal support for men and women residing with and afflicted by HIV/AIDS.
In June 2019, a Housing Works patient submitted a request a copy of his healthcare records. In July 2019, the patient filed a complaint with OCR indicating Housing Works’ failure to provide the records. OCR investigated the complaint, gave the needed technical assistance, then closed the case. But Housing Works still did not provide the patient with a copy of his healthcare records. So, in August 2019, the patient filed a second complaint with OCR.
OCR re-investigated the case and issued Housing Works a financial penalty for violating the HIPAA right of access. In November 2019, Housing Works furnished the complainant his healthcare records and paid $38,000 to resolve the violation. Housing Works also adopted a corrective action plan and is under monitoring by OCR for one year.
Beth Israel Lahey Health Behavioral Services
Beth Israel Lahey Health Behavioral Services (BILHBS) is the biggest mental health and substance use disorder service provider in eastern Massachusetts. In April 2019, OCR got a complaint stating that BILHBS did not respond to a request sent by a personal representative for a copy of her father’s health records. The complainant asked for the information in February 2019, but did not provide even after two months.
OCR investigated the complaint and the patient got the requested health records in October 2019. OCR issued a financial penalty on BILHBS for violating the HIPAA Right of Access. BILHBS paid $70,000 to settle the violation and followed a corrective action plan under the monitoring of OCR for a year.
King MD
King MD is a small psychiatric services provider in Virginia. In October 2018, OCR got a complaint from a patient who did not receive a copy of medical records within two months of filing the request. OCR provided technical assistance on the case but got a second complaint in February 2019 because King MD still did not provide the requested medical records. The patient got the records in July 2020.
King MD paid OCR $3,500 as case settlement. King MD has implemented a corrective action plan under two-year monitoring by OCR.
All Inclusive Medical Services, Inc.
All Inclusive Medical Services, Inc. (AIMS) in Carmichael, CA is a family medicine clinic offering multiple specialty services such as internal medicine, rehabilitation, and pain management.
In January 2018, a patient requested a copy of her medical records, but AIMS did not provide the records. In April 2018, the patient complained to OCR, which prompted an investigation. AIMS was found to have violated the HIPAA right of access. The patient got her copy of the records in August 2020.
OCR received $15,000 from AIMS as a penalty to resolve the HIPAA violation. A corrective action plan was also undertaken to be monitored by OCR for 2 years.
Wise Psychiatry, PC.
Wise Psychiatry is a small psychiatric services provider located in Colorado. In November 2017, a personal representative requested a copy of her young son’s health records. By February 2018, no records were still provided and so she filed a complaint with OCR, which prompted an investigation. OCR gave technical assistance and closed the case.
In October 2018, OCR received a second complaint from the same person. Finally, a copy of the health records was given in May 2019 after OCR’s investigation. Wise Psychiatry paid $10,000 to settle the case and adopted a corrective action plan under OCR’s monitoring for one year.
