​The U.S. Department of Health and Human Services ("HHS"), Office for Civil Rights ("OCR") continues to be actively engaged in investigating and settling alleged HIPAA violations. In advance of Mother's Day, two decisions were announced for HIPAA-covered entities that allegedly did not provide timely copies of a mom's medical records to her child when requested. 

What You Need to Know:

• HHS OCR continues to enforce HIPAA compliance against covered entities.
• The Right of Access Initiative requires timely replies to provide PHI when requested.
• It is never a good idea to delay a request for a mother's PHI 

On March 29, 2024, OCR announced its 47th enforcement action pursuant to its Right of Access Initiative (the "Initiative"). The Initiative is part of OCR's activities to ensure a HIPAA-covered entity provides access to protected health information ("PHI") within 30 days of receiving an individual's request. 

Phoenix Healthcare ("Phoenix") is an Oklahoma multi-facility nursing care organization. OCR's investigation involved a daughter, serving as a personal representative for her mother, who was not able to obtain access to her mother's PHI for nearly one year, despite multiple requests.

The OCR settlement with Phoenix describes the long and presumably contentious (and expensive) litigation between the OCR and Phoenix. In March 2021, OCR notified Phoenix of its intention to impose a civil money penalty ("CMP") against Phoenix in the amount of $250,000. In June 2021, Phoenix requested a hearing before an Administrative Law Judge ("ALJ") to contest the CMP. In a February 2023 decision, the ALJ upheld the violations cited by OCR and directed that Phoenix pay a CMP in the amount of $75,000. In April 2023, Phoenix filed its notice of appeal of the ALJ decision, and the HHS Departmental Appeals Board affirmed the ALJ decision in August 2023. 

Ultimately, OCR and Phoenix agreed to a settlement in which Phoenix agreed to pay to OCR $35,000 to resolve the dispute. As part of the OCR settlement, Phoenix also agreed to revise its HIPAA Policies and Procedures to address (1) the Privacy Rule's requirements concerning an individual's right of access to Protected Health Information, and (2) its obligations to enter into Business Associate Agreements. Phoenix also agreed to share with OCR copies of all training materials it will use to train its workforce members regarding its revised set of HIPAA Policies and Procedures. OCR reserves the right to revert to a $75,000 CMP, which could include offsets from government payors, if Phoenix does not fulfill its settlement obligations. 

On April 1 (no joke), 2024, OCR entered into a $100,000 settlement with a New Jersey-based skilled nursing facility affiliated with Hackensack Meridian Health ("HMH"), which provides long-term care and rehabilitation services, also for failing to provide a patient's personal representative with timely access to the patient's medical records. 

In May 2020, OCR received a complaint alleging that HMH failed to provide a son with access to his mother's medical records. The requested records, which were ultimately provided in November 2020, were allegedly withheld even after HMH received sufficient documentation demonstrating that the son was serving as his mother's personal representative. In September, 2023, OCR issued a Notice of Proposed Determination seeking to impose a civil money penalty. HMH did not contest OCR's findings and OCR imposed a $100,000 CMP as part of the Notice of Final Determination.

Investigations related to enforcement through the Initiative can take a long time to resolve or be adjudicated and may include significant monetary settlements or CMPs (plus the legal fees and time and corrective action that OCR may require). Timely access to PHI for moms and other individuals is an essential right under HIPAA, and covered entities should have policies in place that comply with the timely turnaround required. These two HIPAA-covered entities paid the price for not honoring the moms' wishes for their children to have timely access to the moms' PHI. Bottom line – it is never a good idea to disappoint a mother.