In late November of 2024, the Department of Health and Human Services’ (HHS) Office for Civil Rights announced that it had imposed a $100,000 civil monetary penalty (CMP) on California-based Rio Hondo Community Mental Health Center (Rio Hondo). OCR imposed the penalty because Rio Hondo failed to provide a patent with her medical records – for a full seven months – despite the patient’s repeated requests for access to the records.
HIPAA Right of Access Violation: Groundhog Day
The Los Angeles County Department of Medical Health (LACDMH) operates Rio Hondo as a mental health outpatient program. The Complainant visited Rio Hondo on March 18, 2020, at the beginning of the COVID-19 pandemic. While the patient was at the facility, she completed Rio Hondo’s paper medical records request form.
On March 19, California governor Gavin Newsom issued a “stay-at-home” order “to protect the health and well-being of all Californians and to establish consistency across the state in order to slow the spread of COVID-19.”
In response to the order, Rio Hondo staff worked remotely for about two months, then returned to the facility in May. At that time, Rio Hondo notified the complainant via phone that she could pick up her records on May 27.
May 27 was not an auspicious day for either party: After the Complainant arrived at the clinic and waited 20 minutes to receive the records, she left her contact information with a staff member, asking to be notified when the records would in fact be ready. The complainant then left the clinic. (During its subsequent investigation of Rio Hondo, OCR learned that the clerk in charge of responding to medical requests delayed meeting with the complainant to consult with multiple colleagues about how to process the request (what exactly the point of confusion was, the investigation did not reveal). OCR also learned that Rio Hondo made no further attempts to contact the complainant that day.)
The complainant made additional calls in July and August of 2020 to inquire on the status of her requests. On one occasion, her call was transferred to the medical records department. No one there answered. On another occasion, the complainant spoke with a staff member about the request, but did not receive any follow-up to fulfill the request.
The complainant filed a complaint with OCR in late August, alleging a right of access violation. In October, OCR notified Rio Hondo that OCR was investigating the complaint. Rio Hondo then took action….. by leaving voicemails with the complainant throughout October. In mid-October, Rio Hondo even issued a “letter of apology” to the complainant, in which it acknowledged its tardiness in processing the complaint. At that time, Rio Hondo told the complainant that a copy of her medical records would be sent to her, via certified mail.
Finally, the complainant, after the written request, office visit, phone calls, voicemails, apology, and incidentally, commencement of the investigation, received her records on October 20, 2020. 216 days passed between the initial March 18th request and the receipt (the right of access rule allots 30 days to a provider to either provide the records, or to seek a 30-day extension for a legitimate reason).
HIPAA Right of Access Violation: The Day After Tomorrow
In August of 2022, OCR informed Rio Hondo of the results of its investigation – that Rio Hondo had failed to provide Complainant with timely access to her requested PHI. OCR also gave Rio Hondo a way out, offering to informally settle the matter. Then, in February of 2023, OCR issued a Letter of Opportunity (LOO), which again informed Rio Hondo that its investigation indicated a violation, and which noted that the matter had not been resolved by informal means despite OCR’s attempts to do so.
The letter provided Rio Hondo with an opportunity to submit written evidence of mitigating factors and affirmative defenses, which OCR stated it would consider in determining whether to issue a CMP, and in determining the amount of the CMP.
Rio Hondo submitted a response to the LOO on February 16, 2023. Rio Hondo argued, essentially, that the CMP was unwarranted because COVID:
“Rio Hondo received the Complainant’s written request for records on March 18, 2020, at the onset of the COVID-19 pandemic, just as the mandated statewide “Safer at Home” order went into effect. The action caused all operations to come to an unexpected and immediate halt in order to protect the health and safety of California’s population.”
“The “Safer at Home” order generated unforeseeable changes in Rio Hondo’s infrastructure; all County buildings were closed to the public, most employees were working from home or deployed to conduct disaster response efforts in the field, and there were little to no staff working in the clinics for a considerable period.”
“Upon limited staff returning to the clinic in May 2020, the Complainant’s request was processed, and the Complainant was notified when the record was available to receive.”
“Rio Hondo made attempts after May 27, 2020, to inform the Complainant the records were ready, but the Complainant did not respond. Rio Hondo mailed the records via certified mail on October 20, 2020.”
“As the result of the complaint, Rio Hondo has implemented new protocols to ensure the same or similar situations will not occur in the future.”
OCR was unimpressed with Rio Hondo’s defense of its HIPAA right of access violation. During COVID, the right of access rule was not suspended or revoked. In other words, it was still the law, as it is today.
HIPAA Right of Access Violation: Judgment Day
In July of 2024, OCR issued a Notice of Proposed Determination to impose a $100,000 civil monetary penalty on Rio Hondo for the HIPAA right of access violation. Rio Hondo waived its right to a hearing before an administrative law judge. Through the waiver, Rio Hondo chose not to contest OCR’s Proposed Determination (e.g., the $100,000 CMP). OCR then issued a Notice of Final Determination in August, requiring payment in full of the $100,000.
HIPAA Right of Access Violation: A Reminder from OCR
Upon OCR’s issuing the press release announcing the CMP, OCR Director Melanie Fontes Rainer noted, “Patients should never be in the position of needing to request their own medical records over and over again before getting access to them.” “Ensuring patients’ rights to timely access to medical information continues to be a HIPAA enforcement priority. Healthcare providers are legally obligated to provide patients with timely access to their medical records. If they fail to provide that access, OCR will not hesitate to do everything in its power, including imposing civil monetary penalties, to ensure compliance with the law.”
