On September 10, 2021, the Office for Civil Rights (“OCR”) at the U.S. Department of Health and Human Services (“HHS”) announced the twentieth settlement of an enforcement action under its HIPAA Right of Access Initiative (the “Initiative”). The Initiative is an OCR enforcement priority under the Health Insurance Portability and Accountability Act (“HIPAA”) Privacy Rule to support individuals’ right to timely access their health records at a reasonable cost.

What You Need to Know:

• OCR’s HIPAA Right of Access Initiative remains an enforcement priority for the Biden Administration.
• HIPAA-covered entities are reminded of the importance of complying with the HIPAA right of access standard.
• Covered entities should ensure they have easy access to off-site medical records and records which may be held by multiple entities that are a part of the overall health system.

In this settlement, Children’s Hospital & Medical Center (“CHMC”), a pediatric health care provider in Omaha, Nebraska, agreed to take certain corrective actions and pay $80,000 to settle a potential violation of HIPAA’s right of access standard. On January 3, 2020, a parent submitted a written request to CHMC for access to her deceased minor daughter’s medical records. CHMC provided a portion of the requested records. The remainder of the records needed to be collected from another CHMC division. In May 2020, the complainant filed a complaint with OCR. OCR investigated and determined CHMC’s failure to provide timely access to the requested medical records was a potential violation of the HIPAA right of access standard. Under the right of access standard, a HIPAA-covered entity must take action on a records request within thirty days, or sixty days if an extension is applicable. As a result of the OCR investigation, CHMC provided the remaining records to the complainant on June 20, 2020 and July 16, 2020, more than seven months after the initial request was submitted.  

In addition to the monetary settlement, CHMC entered into a Corrective Action Plan (“CAP”) that did not result in CHMC admitting liability. Under the CAP, CHMC will be subject to two (2) years of HHS monitoring and must do each of the following:

• Develop, maintain, and revise its written HIPAA right of access policies and procedures, which must be submitted to HHS for review and approval;
• Ensure such revised policies and procedures include minimum content requirements set forth in the CAP;
• Distribute HHS-approved policies and procedures to members of CHMC’s HIPAA workforce and provide proof of such distribution to HHS;
• Submit for HHS review revised HIPAA workforce training materials and, upon receiving HHS’ approval, train CHMC’s workforce members using the revised training materials; and
• Report to HHS any workforce member who materially fails to comply with the revised policies and procedures described above.

This settlement – the sixth under the Biden Administration – should be a reminder to all HIPAA-covered entities that compliance with the HIPAA right of access remains important and privacy rights will likely continue to be a priority of this presidential administration. Covered entities should review their HIPAA policies and procedures to ensure they are providing individuals with complete medical records at a reasonable cost promptly when requested. Covered entities should also ensure they have easy access to off-site medical records and records which may be held by multiple entities that are a part of the overall ‘system’ to ensure compliance with the requirements of the HIPAA right of access standard.