Home 5 Lab Industry Advisor 5 Essential 5 OCR Doles Out Record Fine for Right of Access Violation

OCR Doles Out Record Fine for Right of Access Violation

by | Aug 16, 2022 | Essential, HIPAA-nir, National Lab Reporter

On July 15, the Department of Health & Human Services Office for Civil Rights announced 11 new enforcement actions, including the biggest penalty doled out since the agency began the right of access program back in April 2019—$240,000 against Texas nonprofit Memorial Hermann Health System.

While federal healthcare enforcement policy has changed significantly since the Biden administration took over, the one initiative that has remained on steady course is the crackdown on providers that fail to provide patients timely access to their protected health information (PHI) under the HIPAA Privacy Rule. On July 15, the Department of Health & Human Services (HHS) Office for Civil Rights (OCR) announced 11 new enforcement actions, including the biggest penalty doled out since the agency began the right of access program back in April 2019—$240,000 against Texas nonprofit Memorial Hermann Health System.

The HIPAA Privacy Rule 30-Day Rule

The HIPAA Privacy Rule requires labs and other covered entities to respond to an individual’s request for access to their PHI within 30 calendar days. Providers can extend the deadline an additional 30 calendar days by sending the requestor a written statement explaining the reasons for the delay and the date by which the access request will be processed.

These timelines apply regardless of whether the requested PHI is maintained by the covered entity or a business associate acting on its behalf. In other words, labs don’t get extra time to sort things out with their business associates. Significantly, the 30-day clock begins to tick when the access request is received rather than the date any negotiations with the requestor end.

The OCR Right of Access Crackdown

Foot dragging has been a problem almost from the moment the 30-day right of access rule took effect. Previously, patients would complain to the OCR, which would then intervene and maybe issue a warning to the provider. Actual penalties, however, were fairly rare.

All that changed in April 2019, when the OCR announced a new enforcement initiative to impose penalties on access delays. “It should not take a federal investigation before a HIPAA covered entity provides patients, or their personal representatives, with access to their medical records,” noted current OCR director Lisa J. Pino in announcing the latest round of enforcement actions.

The OCR has now handed out 38 penalties, seven of them in the six-figure range, under the initiative. In addition to the monetary settlement, each accused provider was required to implement a corrective action plan and allow the OCR to conduct close monitoring for one to two years.

Here’s a scorecard of all announced settlements to date.

OCR Right of Access Initiative Settlements Scorecard (as of August 5, 2022)

ProviderSettlement AmountAllegations
Memorial Hermann Health System$240,000Texas nonprofit health system’s billing department failed to provide patient complete medical and billing records despite 5 different requests
Banner Health ACE$200,000OCR cites two occasions in which Phoenix-based not-for-profit health system took about 6 months to provide patients their requested PHI
Rainrock Treatment Center, LLC dba Monte Nido Rainrock$160,000Florida eating disorder treatment center took more than 8 months to fulfill patient’s request for a copy of her medical records
St. Joseph’s Hospital and Medical Center$160,000Phoenix hospital refused to provide PHI to patient’s mother even though she was his legal representative
ACPM Podiatry$100,000In response to initial complaint and OCR intervention, Illinois podiatry practice agreed to provide patient requested medical records but reneged on its agreement despite patient’s multiple requests
Dr. Robert Glaser$100,000New York cardiovascular disease and internal medicine doctor didn’t cooperate with OCR’s investigation or respond to its data requests after not providing patient a copy of their medical record
NY Spine Medicine$100,000Neurology practice refuses patient’s multiple requests for copies of specific diagnostic films
Bayfront Hospital$85,000Florida hospital didn’t provide expectant mother timely access to the PHI of her unborn child
Korunda Medical$85,000After first refusing to provide it at all, Florida primary care and interventional pain management services provider sent patient’s PHI to third party in the wrong format and charged him excessive fees
Children’s Hospital & Medical Center$80,000Nebraska hospital failed to provide mother of minor patient timely access to her daughter’s medical records, despite repeated requests
Renown Health, P.C.$75,000Nevada private, not-for-profit health system didn’t timely honor patient’s request to transfer her EHR and billing records to a third party
Sharp Rees-Stealy Medical Centers$70,000California hospital and healthcare network didn’t timely honor request to transfer patient’s EHR to a third party
Beth Israel Lahey Health Behavioral Services$70,000Massachusetts provider ignored request of personal representative seeking access to her father’s PHI
Southwest Surgical Associates$65,000Group practice in Greater Houston, TX area failed to provide patient timely access to their requested PHI
Arbour Hospital$65,000Massachusetts mental health services provider kept patient waiting 5 months before granting access to his PHI
University of Cincinnati Medical Center, LLC$65,000Ohio academic medical center failed to respond to patient’s request to send an electronic copy of her medical records maintained in its EHR to her lawyers
Hillcrest Nursing and Rehabilitation$55,000Massachusetts rehab agency failed to provide an individual’s personal representative with timely access to her son’s medical records
MelroseWakefield Healthcare$55,000Massachusetts provider didn’t furnish personal representative timely access to medical records under a durable power of attorney based on mistaken belief that the power of attorney didn’t permit provision of those records
Erie County Medical Center Corporation$50,000Buffalo, NY hospital didn’t timely provide individual a complete copy of his medical records
Housing Works Inc.$38,000New York City non-profit services provider refused patient’s request for a copy of his medical records
Peter Wrobel, M.D., P.C., dba Elite Primary Care$36,000Georgia primary care practice failed to provide patient access to his medical records
*Advanced Spine & Pain Management$32,150Ohio pain services provider took nearly 4 months to provide patient requested medical records
Fallbrook Family Health Center$30,000Nebraska provider failed to provide timely access to medical records
Dr. Donald Brockley, D.D.M$30,000Pennsylvania solo practitioner dentist failed to provide a patient a copy of their medical record
Denver Retina Center$30,000Colorado ophthalmological services provider took 8 months to provide requested medical records and lacked compliant access policies
Village Plastic Surgery$30,000New Jersey practice failed to provide patient timely access to his medical records
Jacob and Associates$28,000Psychiatric practice with two offices in California failed to provide a patient requested access to her medical records, ignoring her annual requests for 5 years in a row
Riverside Psychiatric Medical Group$25,000California medical group didn’t provide patient copy of her medical records despite repeated requests and OCR intervention
Associated Retina Specialists$22,500New York provider didn’t give patient a copy of her medical records until three days after OCR initiated its investigation, and nearly 5 months after the patient’s first written request
Coastal Ear, Nose, and Throat$20,000Ormond Beach, Florida practice didn’t provide patient timely access to medical records despite multiple requests
Dr. Rajendra Bhayani$15,000NY physician didn’t provide patient her medical records even after OCR intervened and closed the complaint
All Inclusive Medical Services, Inc.$15,000California multi-specialty family medicine clinic refused patient’s requests to inspect and receive a copy of her records
Wake Health Medical Group$10,000North Carolina primary care provider never furnished requested records despite charging patient $25 access fee
Wise Psychiatry, PC$10,000Colorado psychiatric firm refused to provide personal representative access to his minor son’s medical record
Lawrence Bell, Jr., D.D.S.$5,000Baltimore, MD dental practice failed to provide timely access to a patient’s medical record
Diabetes, Endocrinology & Lipidology Center, Inc.$5,000West Virginia diabetes clinic made the mother of a minor patient wait nearly 2 years for access to his medical records
King MD$3,500Virginia psychiatric practice didn’t provide patient access to her medical records even after OCR intervened, provided technical assistance, and closed the complaint

*In addition to the monetary settlement, each accused provider had to agree to implement a corrective action plan and allow the OCR to conduct close monitoring for one to two years

Subscribe to view Essential

Start a Free Trial for immediate access to this article