The Office for Civil Rights (“OCR”) at the U.S. Department of Health and Human Services (“HHS”) recently announced it had settled its 10th and 11th enforcement actions in its HIPAA Right of Access Initiative (the “Initiative”). The Initiative is an OCR enforcement priority to ensure individuals can easily and timely access their health records at a reasonable cost under the Health Insurance Portability and Accountability Act (“HIPAA”). These settlements follow several other recent OCR settlements under the Initiative including against NY Spine Medicine, St. Joseph’s Hospital and Medical Center and five other health care providers. The Initiative is one of the few areas within the health care delivery system where the Trump Administration has taken aggressive enforcement actions.
In the 10th enforcement action, Riverside Psychiatric Medical Group (“Riverside”) agreed to take corrective actions and pay $25,000 to settle a potential violation with respect to the Initiative. Riverside is a group practice based in Riverside, California specializing in child and adolescent psychiatric, geriatric psychiatry, neuropsychiatric, psychology, and substance use disorders.
In March 2019, OCR received a complaint from a patient alleging that Riverside failed to provide the complainant with a copy of her medical records despite multiple requests beginning in February 2019. After receiving the complaint, OCR provided Riverside with technical assistance regarding how to comply with the HIPAA Right of Access requirements and closed the matter. However, in April 2019, OCR received a second complaint stating Riverside still had not provided the patient with access to her medical records.
OCR investigated and determined that Riverside’s failure to respond to the complainant’s request was a potential violation of the Initiative. Riverside argued that because the requested records included psychotherapy notes, which are maintained outside the medical record and afforded different protections under HIPAA, Riverside did not need to comply with the request. Although HIPAA covered entities are not required to produce psychotherapy notes, the HIPAA regulations do require that covered entities provide requestors with a written explanation when the covered entity denies record requests and provide the individual with access to his or her medical records other than the psychotherapy notes. Riverside did not comply with these requirements. As a result of OCR’s investigation, Riverside sent the complainant all of the requested information in her medical record (excluding psychotherapy notes) in October 2020. In addition to the monetary settlement, Riverside entered into a Corrective Action Plan (“CAP”), which did not result in an admission of liability.
In the 11th enforcement action, Dr. Rajendra Bhayani, a private practitioner specializing in otolaryngology in Regal Park, New York, agreed to enter into a CAP and pay $15,000 to settle a potential violation of the Initiative. In September 2018, OCR received a complaint alleging that Dr. Bhayani failed to provide a patient with her medical records requested in July 2018. OCR provided Dr. Bhayani with technical assistance on complying with HIPAA’s Right of Access requirements and closed the complaint. In July 2019, OCR received a second complaint alleging that Dr. Bhayani had not provided the complainant with her records. OCR investigated and determined that Dr. Bhayani’s failure to provide the requested records was a potential HIPAA violation. The complainant was ultimately provided a copy of her medical records in September 2020.
OCR’s ongoing enforcement of potential Initiative violations is an important reminder to all HIPAA covered entities -- including medical practices large and small -- that they must comply with the HIPAA Right of Access standard. Covered entities should review their HIPAA policies and procedures to ensure they are providing individuals with timely and complete medical records upon request, including policies addressing psychotherapy notes if applicable.
