For those providers who somehow missed or ignored the first 15 settlements in the series, the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) recently announced that Sharp HealthCare, doing business as Sharp Rees-Stealy Medical Centers, agreed to pay a $70,000 fine for failing to provide a patient with timely access to his medical records. California-based Sharp operates seven hospitals, three affiliated medical groups and a health plan.

OCR’s Right of Access Initiative has been ongoing since September 2019 and the facts underlying this latest settlement are depressingly familiar:  The provider failed to provide the patient with a copy of his medical records within 30 days, as the HIPAA Privacy Rule requires; the patient complained to OCR; OCR investigated and “provided technical assistance” to Sharp regarding the requirement (in other words, informed Sharp of what its workforce should already have known); OCR closed the file; Sharp still did not provide the records to the patient, who then complained to OCR again; and OCR intervened again, this time fining the provider. The patient finally received his records more than six months after his initial request.

In addition to the financial penalty, Sharp was required to agree to a corrective action plan under which it must revise its HIPAA policies and procedures and train its workforce on individuals’ right to access their own health information. Any provider, large or small, that has not recently trained or retrained its workforce regarding the right of access to patient records and other basic HIPAA requirements is urged to do so.