HIPAA Right of Access Initiative: The Settlement
To settle the potential Privacy Rule violation, Renown settled with OCR for $75,000. As part of the settlement, Renown has agreed to a two-year corrective action plan (CAP). Renown is required to take the following actions under the CAP:
- Renown must develop, maintain, and/or revise, as necessary, its written access policies and procedures to comply with the HIPAA Privacy Rule. The policies and procedures must address Renown’s failure to provide timely access to medical records, by describing Renown’s obligations under the right of access provision. The procedures must ensure comprehensive and timely responses to access requests to PHI. The policies and procedures must also outline protocols for training all workforce members involved in receiving or fulfilling access requests.
- Renown must provide the policies and procedures to HHS for approval.
- If HHS recommends any changes to the policies and procedures, Renown must make revisions within 30 days of the recommendations. The revision process will continue until HHS approves the policies and procedures in full.
In a press release accompanying the settlement announcement, Acting OCR Director Robinsue Frobhoese, who has replaced former Director Roger Severino, stated: “Access to one’s health records is an essential HIPAA right and health care providers have a legal obligation to their patients to provide access to their health information on a timely basis.”