On October 9, 2020, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) announced that it has settled its ninth enforcement action under its 2019 HIPAA Right of Access Initiative. The HIPAA right of access provision requires healthcare providers to timely grant patients’ medical record requests. HHS has issued a $100,000 HIPAA right of access fine to NY Spine Medicine (NY Spine), which operates in New York and Miami Beach, for failing to provide a patient with requested diagnostic films.
Why Was the HIPAA Right of Access Fine Issued?
Under the HIPAA Privacy Rule, individuals have a right to timely access their health records at a reasonable cost. NY Spine Medicine (NYSM), a neurology and pain management provider, received a request from one of its patients for a copy of her medical records and diagnostic films. Under the HIPAA right of access rule, records, diagnostic films, x-rays, test results, and similar information must be timely provided to a patient who requests them.
In July of 2019, the patient filed a complaint with OCR, alleging she had requested access to her protected health information (PHI) numerous times, beginning in 2019. NYSM ignored these requests, including one it received by certified mail on June 26. OCR began an investigation in October of 2020. OCR contacted NYSM numerous times between October and February of 2020. Someone finally picked up the phone, on March 6, and was told by OCR that NYSM had an obligation to both cooperate in the investigation and give the patient her records. As a result of OCR’s investigation, the patient received all of the requested medical records, including the films, in October 2020.
Since having to wait 15 months to receive a copy of one type of medical record does not gel with the HIPAA right of access rule, OCR fined NYSM $100,000, and imposed a two-year corrective action plan (CAP). Under the CAP, NYSM must develop, implement, and actually follow right of access policies and procedures.
OCR Director Severino, commenting on the complaint, literally stated that the fine was issued to send a message. “No one should have to wait over a year to get copies of their medical records. HIPAA entitles patients to timely access to their records and we will continue our stepped up enforcement of the right of access until covered entities get the message,” he said.
