The U.S. Department of Health and Human Services Office of Civil Rights announced this week that it had brought HIPAA-related enforcement actions against five healthcare providers.
The actions brought the total number of enforcements carried out under the agency’s HIPAA Right of Access Initiative to 25.
“Timely access to your health records is a powerful tool in staying healthy, patient privacy and it is your right under law,” said OCR Director Lisa J. Pino in a statement.
WHY IT MATTERS
As the press release notes, the Right of Access Initiative is intended to support individuals’ ability to get their health records in a timely fashion at a reasonable cost, as HIPAA requires.
Without an extension, a HIPAA-regulated entity must provide an individual or a representative with their records 30 days after receiving a request.
In one of the most recent enforcement actions, the Ohio-based Advanced Spine and Pain Management was accused of waiting nearly four months to send a patient a copy of their protected health information. The provider was fined $32,150.
In another, the Rainrock Treatment Center, located in Eugene, Oregon, paid OCR $160,000 after a patient said it had sent their records on May 22, 2020 – almost eight months following the initial request.
In a third, Dr. Robert Glaser was fined $100,000 after failing to provide a patient with his medical records after several years. Glaser, a solo practitioner in New York state, also did not cooperate with the agency’s investigation or respond to OCR’s data requests. Glaser also waived the right to a hearing.
The fourth and fifth enforcement actions also involved delays in releasing medical records to patients. Denver Retina Center paid $32,150 to settle a potential HIPAA violation, and Wake Health Medical Group paid $10,000.
THE LARGER TREND
OCR has been carrying out right of access enforcement actions since 2019, when it fined a Florida hospital $85,000 for failing to give a pregnant woman access to her medical records.
Although the presidential administration – and head of OCR – has changed, the agency shows no signs of slowing: In 2021, it’s pursued roughly a dozen cases.
Still, patients are sometimes driven to bring their own legal actions; in September 2020, a widow living in upstate New York sued a hospital there for allegedly declining to release her deceased husband’s electronic health records in a non-paper format.
ON THE RECORD
“OCR will continue its enforcement actions by holding covered entities responsible for their HIPAA compliance and pursue civil money penalties for violations that are not addressed,” said Pino.
Kat Jercich is senior editor of Healthcare IT News.
Twitter: @kjercich
Email: [email protected]
Healthcare IT News is a HIMSS Media publication.
Source: Read Full Article