The HHS’ Office for Civil Rights (OCR) is moving forward with its effort to penalize healthcare providers that fail to comply with the HIPAA right of access. A week ago, OCR reported its 9th enforcement action against the failure of a HIPAA-covered entity to promptly deliver to patients their requested medical records at an affordable fee.
Under the HIPAA, patients have the right to access or obtain a copy of their health records. Whenever a request to access medical records is submitted, HIPAA-covered entities are required to deliver the requested copy of medical records as quickly as possible. Delivery of the medical records should not be later than 30 days following the filing of the request.
By getting a copy of their health records, patients are able to share that information with their chosen healthcare providers, research institutions, or persons. Patients are able to look at their medical records and check for errors and file requests for error correction. In case of a ransomware attack and the medical records become inaccessible, patients possessing a copy of their medical records are assured that their health records are not lost.
As per the OCR HIPAA Right of Access Initiative, whenever there are complaints received from persons who have been refused medical records access or have experienced delays in obtaining a copy of their medical records, the incidents are investigated. If the HIPAA right of access is found to have been violated, financial penalties are given. The purpose of penalties is to persuade compliance by setting a very high price for noncompliance.
The most recent financial penalty was charged on NY Spine, a privately owned medical practice located in New York and Miami that offers specializations in pain management and neurology. In July 2019, OCR got a patient complaint about having sent multiple requests for a copy of her protected health information (PHI) to NY Spine in June 2019.
NY Spine responded to the patient requests but only furnished some of her medical records, which did not include the specifically requested diagnostic films. It took the involvement of OCR for NY Spine to give those data. In October 2020, the patient eventually got a complete copy of all the requested records. She first submitted her request 16 months ago.
NY Spine agreed to settle the violation by paying OCR $100,000. NY Spine is additionally mandated to undertake a two-year corrective action plan under the monitoring of OCR for compliance.
OCR Director Roger Severino stated that nobody should wait more than a year to obtain copies of their health records. HIPAA gives patients the right to prompt access to their medical records. OCR will keep on enforcing the right of access until finally covered entities catch the message.