On October 9, 2020, the Office for Civil Rights (“OCR”) at the U.S. Department of Health and Human Services (“HHS”) announced it had settled its ninth enforcement action in its HIPAA Right of Access Initiative (the “Initiative”). OCR announced the Initiative in 2019 as an enforcement priority to ensure individuals can easily and timely access their health information at a reasonable cost under the Health Insurance Portability and Accountability Act (“HIPAA”) Privacy Rule. OCR has recently announced several settlements under the Initiative including against St. Joseph’s Hospital and Medical Center and five other health care providers.  

NY Spine Medicine (“NY Spine”) agreed to pay $100,000 and take corrective actions to settle a potential violation of the HIPAA Privacy Rule’s right of access standard. NY Spine is a private medical practice specializing in neurology and pain management with offices in New York City and Miami Beach, Florida.

In July 2019, OCR received a complaint from an individual alleging that NY Spine had failed to provide diagnostic films that the complainant had requested several times, beginning in June 2019. Although NY Spine provided some of the requested medical records, it did not provide specifically requested diagnostic films. OCR investigated and determined that NY Spine’s failure to provide timely access to all requested medical records was a potential violation of the HIPAA right of access standard. As a result of the OCR investigation, the complainant received all of the requested medical records in October 2020, over a year after the individual’s initial request.

In addition to the monetary settlement, NY Spine entered into a corrective action plan (“CAP”), which did not result in an admission of liability by NY Spine. Under the CAP, NY Spine will be subject to two (2) years of monitoring and must do each of the following:

• Develop, maintain and revise its written right of access policies and procedures, to be submitted to HHS for review and approval;
• Designate a privacy official responsible for the development and implementation of such HHS-approved policies and procedures;
• Distribute HHS-approved policies and procedures to members of its workforce and its relevant business associates;
• Ensure policies and procedures include minimum content requirements set forth in the CAP;
• Submit for HHS review revised training materials and, upon receiving HHS’ approval, train workforce members utilizing the revised training materials; and
• Report to HHS any workforce member who materially fails to comply with the revised policies and procedures described above.

NY Spine’s settlement and CAP are a reminder to all HIPAA-covered entities of the importance of complying with the right of access standard or potentially face an investigation as OCR continues to pursue the Initiative. Covered entities should review their HIPAA policies and procedures to ensure they are providing individuals with timely and complete medical records upon request, including diagnostic films if requested, at a reasonable cost.