American Medical Response Settles with HHS for $115K

The Complaint and the Settlement

A patient requested a copy of their medical records from American Medical Response (AMR). After several attempts, and AMR’s failure to provide the records, the patient issued a complaint with OCR. OCR then launched an investigation, and in response, AMR provided the patient with the requested records. AMR also amended its policies and procedures to ensure that they meet future medical record requests appropriately. 

To close the investigation, AMR waived its right to a trial and agreed to pay a $115,200 civil monetary penalty.

“HIPAA gives patients a right to timely access to their medical records,” said OCR Director Melanie Fontes Rainer. “OCR will continue to enforce this right through investigations, and when necessary, by imposing civil money penalties.”

What is the HIPAA Right of Access?

The HIPAA right of access standard requires healthcare organizations to meet a patient’s request to receive a copy of their medical records. These records must be provided to the patient, or their personal representative, within thirty days of the request (or within 60 days if an extension is applicable). 

Records must also be provided in the format the patient requests them in when it is reasonably appropriate to do so, and places limitations on the cost that can be charged for providing the records.

Under this standard, healthcare organizations must provide patients with access to all protected health information contained in their “designated record set.” There are two categories of information, however, that are expressly excluded from the right of access:

• Psychotherapy notes of a mental healthcare provider documenting or analyzing the contents of a counseling session. These notes are maintained separate from the rest of the patient’s medical record. 
• Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding.