OCR continues aggressive HIPAA Right of Access enforcement activities

The U.S. Department of Health and Human Services (HHS) Office of Civil Rights (OCR) has announced a flurry of enforcement actions in the last quarter of 2020 as part of its Right of Access Initiative.

The Right of Access Initiative began in 2019 with OCR declaring its intention to enforce vigorously the rights of patients to receive copies of their medical records promptly and without being overcharged. Since then, this initiative has remained a top enforcement priority of OCR. There have been thirteen separate enforcement actions, including six in the final quarter of 2020, making good on the warning from OCR Director Roger Severino that “it's time for serious enforcement” in this area.

The actions generally follow a familiar pattern in which a patient has difficulty getting a copy of their medical records that is complete, in a timely manner or in the format requested. It is noteworthy that usually these actions are based on a single individual’s complaint. Perhaps most informative are the comments from OCR Director Severino accompanying the announcements, as highlighted in the summary of these most recent actions:

• Elite Primary Care – the thirteenth Right of Access enforcement action, December 2020.  Elite Primary Care paid $36,000 and agreed to a corrective action plan that includes two years of monitoring by OCR. Based on a complaint alleging that Elite failed to respond to a patient's request for access to his medical records despite OCR providing technical assistance to Elite on the HIPAA right of access requirements. OCR Director Severino commented "OCR created the Right of Access Initiative to address the many instances where patients have not been given timely access to their medical records. Health care providers, large and small, must ensure that individuals get timely access to their health records, and for a reasonable cost-based fee."

• University of Cincinnati Medical Center (UCMC) – the twelfth Right of Access enforcement action, November 2020. UCMC paid $65,000 and agreed to a corrective action plan that includes two years of monitoring by OCR. Due to a complaint alleging that UCMC failed to respond to a patient’s request directing UCMC to send an electronic copy of her medical records maintained in UCMC’s electronic health record to her lawyers. OCR Director Severino stated “OCR is committed to enforcing patients’ right to access their medical records, including the right to direct electronic copies to a third party of their choice. HIPAA covered entities should review their policies and training programs to ensure they know and can fulfill all their HIPAA obligations whenever a patient seeks access to his or her records.”

• Dr. Rajendra Bhayani – the eleventh Right of Access enforcement action, November 2020. Dr. Bhayani paid $15,000 and agreed to a corrective action plan that includes two years of monitoring by OCR. Stemmed from a complaint that Dr. Bhayani failed to provide a patient with access to her medical records following her request despite OCR providing technical assistance. OCR Director Severino cautioned “[d]octor’s offices, large and small, must provide patients their medical records in a timely fashion. We will continue to prioritize HIPAA Right of Access cases for enforcement until providers get the message.” 

• Riverside Psychiatric Medical Group (RPMG) – the tenth Right of Access enforcement action, November 2020. RPMG paid $25,000 and agreed to a corrective action plan that includes two years of monitoring by OCR. Based on complaint that despite multiple requests RPMG failed to produce medical records, due to the fact that they included psychotherapy notes. Eventual production of the medical records, with psychotherapy notes excluded, was untimely. OCR Director Severino stated “[w]hen patients request copies of their health records, they must be given a timely response, not a run-around.” 

• NY Spine Medicine – the ninth Right of Access enforcement action, October 2020. NY Spine Medicine paid $100,000 and agreed to a corrective action plan that includes two years of monitoring by OCR. Resulted from a complaint from an individual that she made multiple requests for a copy of her medical records but that she was not provided the diagnostic films that she specifically requested.  OCR Director Severino commented “HIPAA entitles patients to timely access to their records and we will continue our stepped up enforcement of the right of access until covered entities get the message.” 

• St. Joseph’s Hospital and Medical Center (SJHMC) – the eighth Right of Access enforcement action, October 2020. SJHMC paid $160,000 and agreed to a corrective action plan that includes two years of monitoring by OCR. Stemmed from a complaint from a mother alleging that SJHMC provided only a partial set of records despite multiple requests for a full copy of her son’s medical records.   OCR Director Severino noted “[i]t shouldn’t take a federal investigation to secure access to patient medical records, but too often that’s what it takes when health care providers don’t take their HIPAA obligations seriously. OCR has many right of access investigations open across the country, and will continue to vigorously enforce this right to better empower patients.”