OCR Announces First Individual Right of Access Enforcement Action
Earlier this year, the U.S. Department of Health and Human Services, Office for Civil Rights (OCR) announced that it would vigorously enforce the rights of patients to receive copies of their medical records in a timely fashion. OCR held true to its word, and, on September 9, 2019, announced the first enforcement action and settlement in its “Right of Access Initiative.” Bayfront Health St. Petersburg (Bayfront) has agreed to pay $85,000 to OCR and adopt a corrective action plan to settle potential violations of HIPAA’s individual rights provision regarding access to protected health information (PHI) in a designated record set. Under HIPAA, unless grounds for a denial exist, a covered entity must provide the individual with access to his or her PHI within 30 days of receipt of the request. If the covered entity is unable to fulfill the request within that time period, HIPAA allows for a one-time extension of an additional 30 days. To understand the Bayfront settlement and what went wrong, a timeline is helpful.
On October 18, 2017, a patient requested fetal heart monitor records from a prior visit. Bayfront replied that the records were not found. On January 2, 2018 and February 12, 2018, the patient’s attorney requested the records. Bayfront provided an incomplete response to the attorney in March 2018 and a complete response on August 23, 2018 (more than nine months following the patient’s initial request). The patient filed an OCR complaint in August 2018, and, as a result of the OCR investigation, Bayfront finally provided a complete copy of the records to the patient in February 2019.
Bayfront’s response to the patient’s request for access to PHI did not meet HIPAA’s 30-day response requirement. According to news reports, Bayfront used a third party vendor to process requests for access to records, and stated that clerical errors were to blame. As part of the settlement, Bayfront must adopt a corrective action plan that includes updating policies and procedures and retraining its workforce.
This enforcement action serves as an important reminder of the individual rights provisions under HIPAA and the need for health care organizations to develop and implement policies and procedures to timely respond to such requests. As OCR Director Roger Severino stated in the Bayfront settlement announcement, “providing patients with their health information not only lowers costs and leads to better health outcomes, it’s the law.”