Since 2019, the Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) has brought a number of enforcement actions against healthcare providers for their failure to comply with the HIPAA Privacy Rule’s right of access standard. This standard requires providers to give patients timely access to their medical records.

HIPAA Right of Access Case

Recently, OCR announced its 19th settlement under its 2019 right of access enforcement initiative. OCR has settled with the Diabetes, Endocrinology & Lipidology Center (DELC) of West Virginia for $5,000 over a potential right of access violation. As part of the OCR case settlement, DELC has agreed to enter into a corrective action plan (CAP). Details of the OCR case settlement are provided below.

DELC HIPAA Right of Access Case

DELC’s solo physician practice in Martinsburg, West Virginia, treats adults and children who suffer from hormonal imbalances. On July 8, 2019, the parent of a DELC patient requested a copy of her minor child’s medical information. The parent did not receive the information, and on August 6, 2019, filed an OCR complaint claiming DELC did not take timely action in response to the request. 

In October of 2019, OCR notified DELC of OCR’s investigation of DELC’s noncompliance with the right of access standard. Upon completion of the investigation, OCR determined that DELC’s failure to provide timely access to the records was a potential HIPAA violation. As a result of the investigation, DELC finally provided the requested records in May of 2021 – nearly two years after the initial request.

DELC settled the complaint by agreeing to pay OCR $5,000, and to submit to a two-year corrective action plan (CAP), in lieu of OCR imposing a civil monetary penalty.

Let’s Simplify Compliance

Do you need help with HIPAA? Compliancy Group can help!

Learn More!
HIPAA Seal of Compliance

The Cure is More Costly Than the Disease

The $5,000 fine is one of the smaller fines OCR has issued. How