In mid-January of 2025, the Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) announced a $60,000 settlement with South Broward Hospital District d/b/a Memorial Healthcare System (Memorial Healthcare System), a Florida health system, concerning a potential violation of the HIPAA Privacy Rule right of access provision.
The agreement marks OCR’s 52nd right of access enforcement action. The first of these enforcement actions dates all the way back to September of 2019. Details of the right of access complaint prompting right of access enforcement action No.52 are provided below.
OCR Settles HIPAA Right of Access Complaint for $60,000 – Time On the Brain
Under the HIPAA Privacy Rule right of access standard, individuals must receive timely access to their health information for a reasonable cost. Generally, when a patient or their representatives makes a request, a provider has 30 days from receipt of that request to provide the records.
The patient, in this case, first sought his records from Memorial Healthcare System on December 30, 2020. The requests he made included requests by mail, by phone, and through Memorial’s patient portal. In this case, the patient was patient, and filed a right of access complaint with HHS in June of 2021, alleging he requested specific medical records (an EEG tracing) on April 26, 2021, but had yet to receive them.
OCR’s investigation of the right of access complaint revealed that the patient requested the EEG tracing records on April 25, 2021 (patient portal), April 26, 2021 (U.S. Mail), and May 23, 2021 (patient portal). None of these requests occasioned a response.
It took OCR’s intervention for that. After OCR initiated its right of access complaint investigation, the patient received his records, on September 29, 2021. A little after a year later, OCR notified Memorial by letter that OCR had found preliminary indications of Memorial’s noncompliance with the right of access standard. OCR notified MHS that MHS could provide written evidence of any mitigating factors, affirmative defenses, or to support a waiver of a civil monetary penalty. Memorial responded to that letter, but failed to submit such evidence.
In July of 2024, OCR informed Memorial that OCR intended to impose a $100,000 CMP for the right of access standard violation. Memorial, wanting its day in court, then requested a hearing before an Administrative Law Judge (ALJ). The parties agreed to settle the right of access complaint before the hearing. Memorial agreed to pay $60,000 to OCR.
“A patient’s right to timely access their own health information is well-established by the HIPAA Privacy Rule,” said OCR Director Melanie Fontes Rainer in a press release announcing the settlement. “Health care entities must be responsive to their patients’ requests for their medical records. Patients should not have to file a complaint with OCR as a necessary step before receiving their records.”
OCR Settles HIPAA Right of Access Complaint for $60,000: Common Ground
Between September 9, 2019, and January 15, 2025 (the day the resolution of right of access enforcement action #52 was announced), 1,955 days passed. 52 right of access enforcement actions were resolved during that time, or, roughly one every 38 days. President Donald Trump will begin his second Presidential term in less than a week. For those keeping score (hopefully no one), during the first Trump administration, a right of access enforcement action resolution was announced roughly once every 36 days. During the Biden administration, a right of enforcement action has been announced once every 38 days. The right of access enforcement initiative has found rare, bipartisan support. The notion that providers who fail to provide patients with access to copies of their medical records in a timely manner should incur legal consequences has, to date, been an uncontroversial one.
