The Office for Civil Rights (OCR) recently announced another settlement involving investigations under its Right of Access Initiative. This settlement, the sixteenth such agreement under the Initiative (and one of the most interesting), involves San Diego-based Sharp HealthCare, doing business as Sharp Rees-Stealy Medical Centers (SRMC). In the settlement, OCR alleged that it received a complaint on June 11, 2019, stating that SRMC “failed to timely respond” to a patient’s request to electronically access his medical records. OCR provided technical assistance to SRMC and closed the case.
OCR subsequently received a second, similar complaint that SRMC still had not received the medical records as of August 19, 2019. OCR notes in the Resolution Agreement with SRMC that SRMC did not provide access to the requested records until October 15, 2019.
In settling with SRMC, OCR stated that its investigation found that SRMC failed to timely respond to the request for the records from the third-party recipient. SRMC agreed to pay the OCR $70,000 to settle the case and to enter into a standard Corrective Action Plan.
The reason this is so interesting is that it is apparent from reading the Resolution Agreement that the request to access the medical records of the patient did not come directly from the patient, but from a third party. Covered entities are often faced with requests for medical records from third parties on behalf of patients. These third parties could be family members, executors of estates, guardians, administrators, parents, or lawyers. Under HIPAA, covered entities are not permitted to simply hand over medical records to individuals who are not the patient, and requests from third parties can be tricky for many reasons. In general, covered entities are prohibited from providing medical records of patients without the patient’s specific authorization. Although the background detailed facts of this settlement are not known, reading between the lines it looks like the request came from the patient’s attorney.
Covered entities often receive requests for medical records from attorneys, but often are not accompanied by HIPAA-compliant authorization forms to enable the covered entity to provide the medical records to the attorney. Although as attorneys we are used to being able to obtain documents on behalf of clients we represent, HIPAA does not allow covered entities to provide medical records to attorneys without a valid HIPAA authorization form. If an attorney provides the covered entity with a valid authorization form, the request is no different than the request of the patient, and the covered entity must provide access to the records under HIPAA and the OCR’s Right of Access Initiative. The lesson here is to treat the valid request from the attorney no differently than the request from the patient and to provide access to the records within the time frame outlined in HIPAA. Otherwise, the attorney may file a complaint with the OCR.
[View source.]
