OCR settles five additional cases in HIPAA Right of Access Initiative

In 2019, the Department of Health and Human Services Office of Civil Rights (OCR) announced the Right of Access Initiative, promising to vigorously enforce the rights of patients to receive copies of their medical records promptly and without being overcharged. Adding to the two enforcement actions settled in 2019, OCR recently announced five additional settlements under the Right of Access Initiative. 

The entities involved include:

• Housing Works, Inc., a New York City-based nonprofit organization that provides health care, homeless services, advocacy, job training, reentry services and legal aid support for people living with and affected by HIV/AIDS
• All Inclusive Medical Services, Inc., a California-based multi-specialty family medicine clinic
• Beth Israel Lahey Health Behavioral Services, the largest network of mental health and substance use disorder services in eastern Massachusetts
• King MD, a small, Virginia-based provider of psychiatric services
• Wise Psychiatry, PC, a small, Colorado-based provider of psychiatric services  

Each of the five cases was initiated by a complaint from the patient, or the patient’s personal representative. In each of the five settlements, in addition to paying a penalty ranging from $3,500 to $70,000, each entity has adopted a corrective action plan to settle the potential violation of the HIPAA Privacy Rule’s right of access provision. The corrective action plans include one to two years of monitoring by OCR. Links to the publicly available corrective action plans are included in OCR’s announcement. 

OCR’s enforcement actions send a message to health care entities about the importance of compliance with the HIPAA rules. In reference to the Right of Access Initiative, and the importance of empowering patients, OCR Director Roger Severino stated, “[p]atients can't take charge of their health care decisions, without timely access to their own medical information.” Covered entities should review their policies and practices to ensure proper response time to patient requests for access to medical records, in compliance with HIPAA rules.