ENFORCEMENT

OCR Continues HIPAA Right of Access Crackdown, but at a Much Slower Pace

Twenty different providers have been hit with fines since the Department of Health and Human Services’ Office for Civil Rights (OCR) launched its HIPAA Right of Access Initiative in April 2019. However, the size of the fines has been relatively small, with only three reaching six figures. Perhaps more significantly, the pace of reported Access Initiatives has slowed noticeably since the new Biden administration.

Implication: Either the OCR isn’t reporting settlements, or the new regime is less interested than its predecessor in pressing forward on access enforcement actions. Here’s a summary of all of the reported settlements so far, including the most recent $80,000 action against a children’s hospital in Nebraska.

OCR Right of Access Initiative Settlements Scorecard (as of Sept. 27, 2021)

Provider Settlement Amount* Allegations
Banner Health ACE $200,000 OCR cites two occasions in which Phoenix-based not-for-profit health system took about 6 months to provide patients their requested PHI
St. Joseph’s Hospital and Medical Center $160,000 Phoenix hospital refused to provide PHI to patient’s mother even though she was his legal representative
NY Spine Medicine $100,000 Neurology practice refuses patient’s multiple requests for copies of specific diagnostic films
Bayfront Hospital $85,000 Florida hospital didn’t provide expectant mother timely access to the PHI of her unborn child
Korunda Medical $85,000 After first refusing to provide it at all, Florida primary care and interventional pain management services provider sent patient’s PHI to third party in the wrong format and charged him excessive fees
Children’s Hospital & Medical Center $80,000 Nebraska hospital mother of minor patient timely access to her daughter’s medical records, despite repeated requests
Renown Health, P.C. $75,000 Nevada private, not-for-profit health system didn’t timely honor patient’s request to transfer her EHR and billing records to a third party
Sharp Rees-Stealy Medical Centers $70,000 California hospital and healthcare network didn’t timely honor request to transfer patient’s EHR to a third party
Beth Israel Lahey Health Behavioral Services $70,000 Massachusetts provider ignored request of personal representative seeking access to her father’s PHI
Arbour Hospital $65,000 Massachusetts mental health services provider kept patient waiting 5 months before granting access to his PHI
University of Cincinnati Medical Center, LLC $65,000 Ohio academic medical center failed to respond to patient’s request to send an electronic copy of her medical records maintained in its electronic health record EHR to her lawyers
Housing Works Inc. $38,000 New York City non-profit services provider refused patient’s request for a copy of his medical records
Peter Wrobel, M.D., P.C., dba Elite Primary Care $36,000 Georgia primary care practice failed to provide patient access to his medical records
Village Plastic Surgery $30,000 New Jersey practice failed to provide patient timely access to his medical records
Riverside Psychiatric Medical Group $25,000 California medical group didn’t provide patient copy of her medical records despite repeated requests and OCR intervention
Dr. Rajendra Bhayani $15,000 NY physician didn’t provide patient her medical records even after OCR intervened and closed the complaint
All Inclusive Medical Services, Inc. $15,000 California multi-specialty family medicine clinic refused patient’s requests to inspect and receive a copy of her records
Wise Psychiatry, PC $10,000 Colorado psychiatric firm refused to provide personal representative access to his minor son’s medical record
Diabetes, Endocrinology & Lipidology Center, Inc. $5,000 West Virginia diabetes clinic made the mother of a minor patient wait nearly 2 years for access to his medical records
King MD $3,500 Virginia psychiatric practice didn’t provide patient access to her medical records even after OCR intervened, provided technical assistance and closed the complaint

*In addition to the monetary settlement, each accused provider had to agree to implement a corrective action plan and allow the OCR to conduct close monitoring for one to two years

CLOSE TO VIEW ARTICLE x

You have 2 articles left to view this month.

Your 3 Free Articles Per Month Goes Very Quickly!
Get a 3 month Premium Membership to
one of our G2 Newsletters today!

Click on one of the Newsletters below to sign up now and get unlimited access to all articles, archives, and tools for that specific newsletter!

Close

EMAIL ADDRESS


PASSWORD
EMAIL ADDRESS

FIRST NAME

LAST NAME

TITLE

COMPANY

PHONE

Try Premium Membership

(-00000g2)