The Office for Civil Rights ("OCR") has turned its focus on individuals' right to timely access to their health records at a reasonable cost under the HIPAA Privacy Rule. Settling eight enforcement actions this year, the OCR is making a clear statement that it should not take federal intervention for patients to be provided with copies of their medical records.

The latest settlement involves Dignity Health, doing business as St. Joseph’s Hospital and Medical Center (“SJHMC”), a large, acute care hospital with several hospital-based clinics based in Phoenix, Arizona. SJHMC has agreed to take corrective actions and pay $160,000 to settle a potential violation of the HIPAA Privacy Rule's right of access provision.

On April 25, 2018, OCR received a complaint from a mother alleging that beginning in January 2018, she made multiple requests to SJHMC for a copy of her son’s medical records, as his personal representative. SJHMC provided some of the requested records, but despite the mother’s follow up requests in March, April, and May 2018, SJHMC did not provide all of the requested records. OCR initiated an investigation and determined that SJHMC’s actions were a potential violation of the HIPAA right of access standard. As a result of OCR’s investigation, SJHMC sent all of the requested medical records to the mother on December 19, 2019, more than 22 months after her initial request. 

The resolution agreement and corrective action plan may be found at: https://www.hhs.gov/sites/default/files/sjhmc-racap.pdf. If you have questions about your practice’s or facility’s medical record policy, you should consult an experienced health care lawyer. Entities that use medical records subcontractors should also periodically review the performance of these subcontractors to avoid non-compliance that may implicate your facility or practice. The OCR has been assertive about its enforcement authority and this is only likely to continue as “timely access” has been a stated priority for OCR.