On September 15, 2020, the United States Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced that it had settled five investigations under its HIPAA Right of Access Initiative. The settlements are part of OCR’s efforts to ensure individuals can access their health records in a timely manner and at a reasonable cost under the Health Insurance Portability and accountability Act (HIPAA) Privacy Rule. OCR previously completed two other enforcement actions under the Right of Access Initiative against Korunda Medical, LLC and Bayfront Health St. Petersburg. Each of the five new settlements is discussed below:
Housing Works, Inc.
Housing Works Inc. (Housing Works) is a nonprofit organization based in New York City that provides health care, homeless services, advocacy, job training, reentry services, and legal aid support for people living with and affected by HIV/AIDS. In July 2019, OCR received a complaint that Housing Works failed to provide the complainant with a copy of his medical records. OCR provided Housing Works with technical assistance on the HIPAA right of access requirements and subsequently closed the complaint.
In August 2019, OCR received a second complaint alleging that Housing Works still had not provided the original complainant with his medical records. OCR investigated and determined that Housing Work’s failure to provide the records was a potential violation of the HIPAA right of access standard. As a result of OCR’s investigation, the complainant ultimately received the records he requested in November 2019, five months following his request.
Housing Works agreed to pay $38,000 to OCR and to adopt a one-year corrective action plan to settle this potential violation.
All Inclusive Medical Services, Inc.
All Inclusive Medical Services, Inc. (AIMS) is a multi-specialty family medicine clinic based in Carmichael, California that provides services including internal medicine, pain management and rehabilitation. OCR received a complaint in April 2018 alleging that in January 2018, AIMS denied a patient’s request to inspect and receive a copy of her medical records. OCR’s investigation resulted in a determination that AIMS’s actions were potential violations of the HIPAA right of access standard. As a result of this investigation, AIMS sent the patient her medical records in August 2020.
AIMS has agreed to pay a settlement of $15,000 and adopt a two-year corrective action plan to settle this potential violation of the HIPAA Privacy Rule's right of access provision.
Beth Israel Lahey Health Behavioral Services
Beth Israel Lahey Health Behavioral Services (BILHBS) is the largest network of mental health and substance use disorder services in eastern Massachusetts. In April 2019, OCR received a complaint stating that BILHBS did not respond to a February 2019 request from a personal representative seeking access to her father’s medical records. OCR’s investigation revealed that BILHBS’ failure to provide the requested records was a potential violation of the HIPAA right of access standard. BILHBS sent the personal representative the requested medical records in October 2019.
BILHBS reached an agreement with OCR to pay $70,000 and to adopt a one-year corrective action plan to settle this potential violation.
King MD
King MD is a small health care provider of psychiatric services in Virginia. In October, 2018, OCR received a complaint alleging that King MD failed to respond to an individual’s August 2018 request to access her medical records. OCR provided King MD with technical assistance relating to the HIPAA right of access requirements and closed that complaint. In February 2019, OCR received a follow-up complaint stating that King MD still had not provided the individual with the requested access to her medical records. OCR initiated an investigation and determined that the practice’s inaction was a potential violation of the HIPAA right of access standard. As a result of the OCR investigation, King MD sent the individual her medical records in July 2020.
King MD has agreed to pay a $3,500 settlement and adopt a two-year corrective action plan to settle this potential violation of the HIPAA Privacy Rule's right of access provision.
Wise Psychiatry, PC
Wise Psychiatry, P.C. (Wise Psychiatry) is a small psychiatric services provider in Colorado. OCR received a complaint in February 2018 alleging that Wise Psychiatry failed to provide a personal representative with access to his minor son’s medical records, which were requested in November 2017. OCR provided Wise Psychiatry with technical assistance on the HIPAA right of access requirements and closed that complaint in April 2018.
In October 2018, OCR received a subsequent complaint alleging that Wise Psychiatry still had not provided the personal representative with access to the requested records. OCR investigated and determined that Wise Psychiatry’s failure to provide the requested records was a potential violation of the HIPAA right of access standard. As a result of OCR’s investigation, Wise Psychiatry sent the personal representative his son’s medical records in May 2019. Wise Psychiatry has agreed to pay $10,000 to OCR and to adopt a one-year corrective action plan to settle a potential violation of the HIPAA Privacy Rule's right of access provision.
As part of their respective settlements, each of these health care providers will undertake corrective action plans, which can be accessed here. OCR’s press release stated that these enforcement actions are intended to send a message to the health care industry about the importance of complying with the HIPAA Privacy Rule. These five settlements are an important reminder that every HIPAA-covered entity must provide individuals with access to medical records in a timely manner and at a reasonable cost.
