On November 30, 2021, the United States Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced its five actions – four settlements and corrective action plans, and one civil money penalty in the amount of $100,000 – under its HIPAA Right of Access Initiative. This announcement is a continuation of OCR’s efforts to ensure individuals can access their health records in a timely manner – within 30 days of a request – and at a reasonable cost under the HIPAA Privacy Rule. OCR has now announced twenty-five enforcement actions since the initiative began in 2019; our coverage of each of these enforcement actions can be found on the Saul Ewing Arnstein & Lehr, LLP HIPAA Resources Page. With respect to the four settlements, the provider did not admit any liability. Each of the five new actions is discussed briefly below:

What You Need to Know:

• OCR has now settled 25 actions under the HIPAA Right of Access Initiative and is likely to continue to pursue Right of Access violations.
• These five actions are an important (and expensive!) reminder that every HIPAA-covered entity must provide individuals with access to medical records in a timely manner and at a reasonable cost.  
• HIPAA-covered entities should ensure they have robust policies and procedures in place to comply with the Right of Access.

Advanced Spine & Pain Management (ASPM)

ASPM provides management and treatment of chronic pain services in Cincinnati and Springboro, Ohio. An HHS investigation found that on November 25, 2019, the complainant submitted to ASPM, in person, a written request seeking access to his protected health information. ASPM acknowledged it received the complainant’s request on the same date but did not send the complainant a copy of his protected health information until March 19, 2020.  
 
As part of the settlement, ASPM agreed to pay $32,150, and enter into a corrective action plan that includes two years of monitoring and the development and distribution of compliant policies and procedures and training of its workforce members.

Denver Retina Center (DRC)

DRC is a Denver, Colorado provider of ophthalmological services. On June 24, 2019, HHS received a complaint alleging DRC failed to provide medical records requested in December 2018. DRC admitted it was aware of the complainant’s request and it was late in responding to the complainant. DRC sent the medical records to the complainant on July 26, 2019. As part of its investigation, HHS found DRC did not have compliant Right of Access policies and procedures.
 
DRC agreed to pay $30,000 and enter into a corrective action plan that includes one year of monitoring and the development and distribution of compliant policies and procedures and training of its workforce members.
 
Dr. Robert Glaser

Dr. Glaser is a sole practitioner specializing in cardiovascular disease and internal medicine in New Hyde Park, NY. Dr. Glaser failed to provide a patient with a copy of their medical record, first requested in 2013. In addition, Dr. Glaser repeatedly failed to cooperate with OCR’s investigation or respond to OCR’s correspondence and numerous data requests.  
 
OCR issued a civil money penalty of $100,000 due to Dr. Glaser’s willful neglect throughout the investigatory process.
 
Rainrock Treatment Center, LLC d/b/a Monte Nido Rainrock (Monte Nido)

Monte Nido is a licensed provider of residential eating disorder treatment services in Eugene, Oregon. On December 4, 2019, January 28, 2020, and February 20, 2020, OCR received complaints against Monte Nido from a patient alleging that Monte Fido failed to provide the complainant with a copy of her medical records in response to access requests on October 1, 2019 and November 21, 2019. Monte Nido did not send the patient the requested records until May 22, 2020.
 
As part of the settlement, Monte Nido agreed to pay $160,000, and enter into a corrective action plan that includes one year of monitoring and the development and distribution of compliant policies and procedures and training of its workforce members.
 
Wake Health Medical Group (WHMG)

WHMG is a Raleigh, North Carolina provider of primary care and other health care services. On December 19, 2020, OCR received a complaint alleging WHMG had not provided the complainant with a copy of her medical records despite making a request in person on June 27, 2019 and paying $25 for the records. WHMG has still not provided the complainant with a copy of her medical records.
 
As part of the settlement, WHMG agreed to pay $10,000, and enter into a corrective action plan that includes two years of monitoring and the development of compliant policies and procedures and training of its workforce members.
 
OCR’s press release quoted OCR Director Lisa J. Pino who stated, “timely access to your health records is a powerful tool in staying healthy, patient privacy and it is your right under law.” OCR Director Pino explained, “OCR will continue its enforcement actions by holding covered entities responsible for their HIPAA compliance and [will] pursue civil money penalties for violations that are not addressed.”
 
These five actions are an important – and expensive – reminder that every HIPAA-covered entity must provide individuals with access to medical records in a timely manner and at a reasonable cost. HIPAA-covered entities should ensure they have robust policies and procedures in place to comply with the Right of Access.