Healthcare providers are generally required by HIPAA to provide patients or their legal representatives with the ability to inspect or obtain copies of their medical records within 30 days of a request (state specific requirements are not addressed herein.) The Office of Civil Rights (OCR) has been enforcing this requirement through its Right of Access Initiative, which it announced in 2019, “promising to vigorously enforce the rights of patients to receive copies of their medical records promptly and without being overcharged.”

The OCR has settled nine enforcement actions (summarized below). All required that settlement amounts be paid to the OCR and that the parties agree upon corrective action plans. In October 2020, the OCR announced the eighth and ninth settlements. These were the largest financial settlements since the initiative was launched – each equal to or greater than $100,000, even though they did not represent the longest waiting periods for the records. Any healthcare organizations not already being extremely diligent about providing patients with timely access to their medical records should take notice. The OCR is not slowing down and appears to be ramping up the penalties to get everyone’s attention.

Roger Severino, the OCR Director, recently stated: “No one should have to wait over a year to get copies of their medical records. HIPAA entitles patients to timely access to their records and we will continue our stepped up enforcement of the right of access until covered entities get the message.” A clear message has been sent to healthcare organizations – there will be potentially severe monetary consequences if HIPAA’s right of access provisions are ignored.