The U.S. Department of Health and Human Services, Office for Civil Rights (“OCR”) recently announced its 46^th settlement under its Right of Access Initiative since it was initially launched in 2019. Allegations in the recent resolution include failure of a multi-specialty physician practice to provide copies of medical records requested by an adult patient or by the parents of minor patients in at least six instances reported by patients in 2021. The HIPAA Right of Access provision requires that individuals or their personal representatives have timely access to their health information for a reasonable cost; generally, this means no more than 30 days from the request (or less if required by state law), and for the lower of HIPAA or state-permitted fees.

The recent resolution agreement includes a $160,000 settlement payment and a corrective action plan (“CAP”). Among the requirements of the one-year CAP include revision of policies and procedures related to access, and training of employees regarding the same. These requirements remind providers of the importance of developing and implementing policies and procedures tailored to the specific organization, and the importance of education for staff. While those staff responsible for responding to access requests should receive detailed training on the requirements, all staff should have a basic knowledge of the requirements to facilitate proper channeling of requests once received.

This resolution agreement again reiterates OCR’s longstanding position that “[a]ccess to medical records is a fundamental right under HIPAA,” and one that OCR continues to make an enforcement priority. As providers look ahead in the new year, this resolution agreement provides a reminder that review and updating of policies and training would be a worthwhile addition to the annual compliance plan. Healthcare providers should coordinate among their departments, including IT, compliance, and legal, to ensure that these operational functions are aligned in their approaches. Together with finalized regulations related to information blocking penalties for healthcare providers expected this year, OCR’s continued focus on patient right of access means that the stakes related to proper response to access requests continue to climb.