It’s not surprising that OCR kicked off 2021 by announcing yet another right of access fine. The fourteenth fine issued under OCR’s right of access initiative was a $200,000 fine issued to Banner Health ACE. The OCR settlement agreement is discussed in detail below.
Banner Health ACE OCR Settlement Agreement
Banner Health affiliated covered entities (Banner Health ACE), a non-profit health system with 30 hospitals, and primary care, specialty care, and urgent care facilities, is one of the largest health systems in the United States.
On January 12, 2021, OCR announced that it had reached a settlement with Banner Health ACE to settle potential HIPAA right of access violations. The OCR settlement agreement requires Banner Health ACE to pay a $200,000 HIPAA fine and adopt a corrective action plan to ensure future compliance. In addition, as part of the OCR settlement agreement, Banner Health ACE is subject to two years of monitoring by OCR.
What led to the OCR settlement agreement?
After receiving two separate complaints from patients alleging that Banner Health ACE violated the right of access, OCR launched an investigation into the organization. The first complaint alleged that a patient requesting her records in December 2017 did not receive her records until May 2018. The second complaint alleged that a patient requesting his records in September 2019 did not receive access to his records until February 2020.
“This first resolution of the year signals that our Right of Access Initiative is still going strong and that providers of all sizes need to respect the right of patients to have timely access to their medical records,” said OCR Director Roger Severino.
What is the HIPAA Right of Access?
The HIPAA right of access requires healthcare organizations to provide patients access to their medical records when requested. The right of access mandates that records are provided to the patient in the format requested within 30 days of the request. In 2019, OCR announced its “HIPAA right of access initiative,” in which they prioritized enforcement of the standard. Since this announcement, OCR has fined fourteen organizations for failing to comply with the standard.
