The U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) has pursued its HIPAA Right of Access Initiative since 2019. OCR’s 19th settlement under the initiative, with The Diabetes, Endocrinology & Lipidology Center, Inc. (DELC), curiously resulted in only a $5,000 fine. The West Virginia provider treats patients who have endocrine disorders.

In August 2019, OCR received a complaint that DELC had failed to provide a copy of a patient’s protected health information within 30 days of the request, as the HIPAA Privacy Rule requires. After OCR’s investigation, the records were finally provided in May 2021, almost two years after the initial request.

In addition to the financial penalty, DELC agreed to a corrective action plan that includes reviewing and updating its policies and procedures and retraining its workforce regarding individuals’ right to access their PHI.