On November 19, 2020, the Department of Health and Human Services’ Office for Civil Rights (OCR) announced its 10th HIPAA Right of Access settlement of the year (its 12th since the Right of Access initiative began in 2019). OCR publicized its first five Right of Access settlements this year just over two months ago. It added two more in October and then three in November. And with a full month left in 2020, there may be more to come.
In this 10th Right of Access settlement, the University of Cincinnati Medical Center (UCMC) agreed to take corrective actions and pay $65,000 to settle claims that it failed to properly respond to a patient’s request for records. In February 2019, the patient requested that UCMC send electronic copies of her records to her lawyers. When UCMC failed to comply, the patient filed a complaint with OCR in May 2019.
While the Resolution Agreement provides no additional facts regarding UCMC’s failure to comply with the patient’s request, providers often are weary of sending records to a patient’s lawyer for fear of a lawsuit. Providers must remember that patients have a right to his or her records (except under very limited circumstances), even if those records contain information that could create liability for the provider.
When there is concern that a records request could have legal implications, Providers should have an internal process for reviewing the records to identify any potential issues. And when issues are identified, it is important to put the insurance carriers on notice. This review process, however, cannot interfere with a patient’s right to timely access to his or her records.
The 10 Right of Access settlements this year have involved varying types of providers and factual scenarios. They all boil down to this: Providers must be better about granting timely and appropriate access to patients’ medical records. I offer more details about all of those actions in previous blog posts in September, October and November. The November blog post also provides important practical tips on avoiding Right of Access issues.
For those of you keeping score, so far this year, OCR has announced 18 enforcement action settlements and the total amount of those settlements is $13,518,900 ($501,500 of which come from Right of Access settlements).