West Virginia Clinic Becomes Most Recent Provider Fined for HIPAA Right of Access Violation

Case: Instead of the required 60 days, it took a West Virginia diabetes clinic two years to provide access to a minor child patient’s mother access to his medical records. In addition to $5,000 to settle a potential HIPAA Privacy Rule violation, the clinic had to agree to implement a corrective action plan providing for two years of Office for Civil Rights (OCR) monitoring. Significance: This is the 19th fine the OCR has handed out since it launched its HIPAA Right of Access Initiative in April 2019 targeting providers for not granting individuals’ access to their own protected health information. Although the initiative remains ongoing, the pace of fines has slowed considerably under the Biden administration. The West Virigina settlement represents the second lowest fine. The highest fine was $200,000. Here’s a Scorecard of all the fines issued so far. OCR Right of Access Initiative Settlements Scorecard (as of July 26, 2021)

Provider	Settlement Amount*	Allegations
Banner Health ACE	200000	OCR cites two occasions in which Phoenix-based not-for-profit health system took about 6 months to provide patients their requested PHI
St. Joseph’s Hospital and Medical Center	160000	Phoenix hospital refused to provide PHI to patient’s mother even though she was his legal representative
NY Spine Medicine	100000	Neurology practice refuses patient’s multiple requests for copies of specific diagnostic films
Bayfront Hospital	85000	Florida hospital didn’t provide expectant mother timely access to the PHI of her unborn child
Korunda Medical	85000	After first refusing to provide it at all, Florida primary care and interventional pain management services provider sent patient’s PHI to third party in the wrong format and charged him excessive fees
Renown Health, P.C.	75000	Nevada private, not-for-profit health system didn’t timely honor patient’s request to transfer her EHR and billing records to a third party
Sharp Rees-Stealy Medical Centers	70000	California hospital and healthcare network didn’t timely honor request to transfer patient’s EHR to a third party
Beth Israel Lahey Health Behavioral Services	70000	Massachusetts provider ignored request of personal representative seeking access to her father’s PHI
Arbour Hospital	65000	Massachusetts mental health services provider kept patient waiting 5 months before granting access to his PHI
University of Cincinnati Medical Center, LLC	65000	Ohio academic medical center failed to respond to patient’s request to send an electronic copy of her medical records maintained in its electronic health record EHR to her lawyers
Housing Works Inc.	38000	New York City non-profit services provider refused patient’s request for a copy of his medical records
Peter Wrobel, M.D., P.C., dba Elite Primary Care	36000	Georgia primary care practice failed to provide patient access to his medical records
Village Plastic Surgery	30000	New Jersey practice failed to provide patient timely access to his medical records
Riverside Psychiatric Medical Group	25000	California medical group didn’t provide patient copy of her medical records despite repeated requests and OCR intervention
Dr. Rajendra Bhayani	15000	NY physician didn’t provide patient her medical records even after OCR intervened and closed the complaint
All Inclusive Medical Services, Inc.	15000	California multi-specialty family medicine clinic refused patient’s requests to inspect and receive a copy of her records
Wise Psychiatry, PC	10000	Colorado psychiatric firm refused to provide personal representative access to his minor son’s medical record
Diabetes, Endocrinology & Lipidology Center, Inc.	5000	West Virginia diabetes clinic made the mother of a minor patient wait nearly 2 years for access to his medical records
King MD	3500	Virginia psychiatric practice didn’t provide patient access to her medical records even after OCR intervened, provided technical assistance and closed the complaint
*In addition to the monetary settlement, each accused provider had to agree to implement a corrective action plan and allow the OCR to conduct close monitoring for one to two years