OCR Holds True to Right of Access Initiative with First Enforcement Action
October 7, 2019
By: Stacy Walton Long and
Earlier this year, the Office of Civil Rights (“OCR”) at the U.S. Department of Health and Human Services (“HHS”) announced its Right of Access Initiative. The Right of Access Initiative promises to vigorously enforce the rights of patients to receive copies of their medical records without facing overcharges.
HIPAA regulations state, except as “otherwise provided . . . an individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set, for as long as the protected health information is maintained in the designated record set, except for: (i) psychotherapy notes; and (ii) information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding.”[1]
Under HIPAA, a covered entity must act on a request for access no later than 30 days after receipt of the request.[2] If the covered entity cannot respond to the request within 30 days, the covered entity may extend the response time for an additional 30 days, provided that: (i) the covered entity provides the individual with a written statement of the reasons for the delay and the date by which the covered entity will complete its action on the request, and (ii) the covered entity may only have one 30 day extension to act on the request.[3] Additionally, the covered entity cannot charge more than a reasonable, cost-based fee for the copies of the individual’s medical records.[4] The right to access records extends to parents who seek medical information about their minor children, including unborn children.[5]
On September 9, 2019, the Office of Civil Rights (“OCR”) at the U.S. Department of Health and Human Services (“HHS”) settled its first enforcement action under its Right of Access Initiative with Bayfront Health St. Petersburg (“Bayfront”).[6] OCR initiated its investigation of Bayfront after receiving a complaint from the mother of an unborn child that Bayfront failed to provide the mother access to her unborn child’s medical records in a timely manner. The mother filed the complaint against Bayfront in August 2018 stating that she submitted a written request for her fetal monitor records from Bayfront in October 2017, but had yet to receive them as of the time she filed the complaint. Ultimately, it took Bayfront more than nine months to provide the mother with the requested medical records.[7]
As a result of the allegations, Bayfront entered into a settlement agreement with OCR to settle a potential violation of the right of access provision of the Health Insurance Portability and Accountability Act (HIPAA). Additionally, Bayfront agreed to pay OCR $85,000 and must adhere to OCR’s corrective action plan. The corrective action plan requires Bayfront to formulate or revise policies and procedures to comply with the HIPAA Privacy Rule and provide HHS with access to the policies and procedures. Moreover, the corrective action plan requires Bayfront to implement and provide training materials approved by HHS to each workforce member and relevant business associate. To access the complete resolution agreement and the corrective action plan, please click here.
If you have questions regarding HIPAA compliance policies or issues or other HIPAA-related questions, please contact Stacy Walton Long, Alexandria M. Foster or any other Krieg DeVault attorney in the Health Care Practice Group.
[1] 45 CFR § 164.524(a)(1).
[2] 45 CFR § 164.524(b)(2).
[3] 45 CFR § 164.524(b)(2)(i)(A-B).
[4] 45 CFR § 164.524(c)(4).
[5] See https://www.hhs.gov/about/news/2019/09/09/ocr-settles-first-case-hipaa-right-access-initiative.html.
[6] Id.
[7] Id. (Bayfront did provide an incomplete set of records in March of 2018 to Complainant’s counsel and provided a complete set of records in August of 2018 to Complainant’s Counsel. Bayfront did not provide the records directly to the Complainant until February of 2019).
October 7, 2019
By: Stacy Walton Long and
Earlier this year, the Office of Civil Rights (“OCR”) at the U.S. Department of Health and Human Services (“HHS”) announced its Right of Access Initiative. The Right of Access Initiative promises to vigorously enforce the rights of patients to receive copies of their medical records without facing overcharges.
HIPAA regulations state, except as “otherwise provided . . . an individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set, for as long as the protected health information is maintained in the designated record set, except for: (i) psychotherapy notes; and (ii) information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding.”[1]
Under HIPAA, a covered entity must act on a request for access no later than 30 days after receipt of the request.[2] If the covered entity cannot respond to the request within 30 days, the covered entity may extend the response time for an additional 30 days, provided that: (i) the covered entity provides the individual with a written statement of the reasons for the delay and the date by which the covered entity will complete its action on the request, and (ii) the covered entity may only have one 30 day extension to act on the request.[3] Additionally, the covered entity cannot charge more than a reasonable, cost-based fee for the copies of the individual’s medical records.[4] The right to access records extends to parents who seek medical information about their minor children, including unborn children.[5]
On September 9, 2019, the Office of Civil Rights (“OCR”) at the U.S. Department of Health and Human Services (“HHS”) settled its first enforcement action under its Right of Access Initiative with Bayfront Health St. Petersburg (“Bayfront”).[6] OCR initiated its investigation of Bayfront after receiving a complaint from the mother of an unborn child that Bayfront failed to provide the mother access to her unborn child’s medical records in a timely manner. The mother filed the complaint against Bayfront in August 2018 stating that she submitted a written request for her fetal monitor records from Bayfront in October 2017, but had yet to receive them as of the time she filed the complaint. Ultimately, it took Bayfront more than nine months to provide the mother with the requested medical records.[7]
As a result of the allegations, Bayfront entered into a settlement agreement with OCR to settle a potential violation of the right of access provision of the Health Insurance Portability and Accountability Act (HIPAA). Additionally, Bayfront agreed to pay OCR $85,000 and must adhere to OCR’s corrective action plan. The corrective action plan requires Bayfront to formulate or revise policies and procedures to comply with the HIPAA Privacy Rule and provide HHS with access to the policies and procedures. Moreover, the corrective action plan requires Bayfront to implement and provide training materials approved by HHS to each workforce member and relevant business associate. To access the complete resolution agreement and the corrective action plan, please click here.
If you have questions regarding HIPAA compliance policies or issues or other HIPAA-related questions, please contact Stacy Walton Long, Alexandria M. Foster or any other Krieg DeVault attorney in the Health Care Practice Group.
[1] 45 CFR § 164.524(a)(1).
[2] 45 CFR § 164.524(b)(2).
[3] 45 CFR § 164.524(b)(2)(i)(A-B).
[4] 45 CFR § 164.524(c)(4).
[5] See https://www.hhs.gov/about/news/2019/09/09/ocr-settles-first-case-hipaa-right-access-initiative.html.
[6] Id.
[7] Id. (Bayfront did provide an incomplete set of records in March of 2018 to Complainant’s counsel and provided a complete set of records in August of 2018 to Complainant’s Counsel. Bayfront did not provide the records directly to the Complainant until February of 2019).