On December 15, 2022, the Department of Health and Human Services’ Office for Civil Rights (OCR) announced its 17th HIPAA Right of Access settlement of the year. Overall, OCR has settled or assessed a penalty in a Right of Access enforcement matter 42 times since it began its Right of Access enforcement initiative in 2019.
As with all the other Right of Access matters, the provider here failed to follow the rules in responding to an access request. The daughter of a deceased patient requested her father’s records from Health Specialists of Central Florida (HSCF) in August 2019. She supplied the appropriate paperwork regarding her legal authority. After not receiving the records, she filed a complaint with OCR in November 2019.
Presumably after hearing from OCR, the provider sent the records on January 27, 2020. After an investigation, OCR found that HSCF failed to timely provide records. HSCF agreed to pay $20,000 to OCR and to participate in a corrective action plan to settle the matter.
This settlement, like others this year, signals a continued shift toward more strict enforcement of the Right of Access rules. When the initiative began in 2019, OCR was more flexible with covered entities (especially smaller practices). It often sent technical assistance letters that gave providers an opportunity to self-correct. That no longer seems to be the case.
This shift means that it is more important than ever for healthcare providers to ensure compliance with the simple Right of Access rules. We did a short video series on this subject, which is available at no cost. The video series is a good training resource to help address the single most enforced aspect of HIPAA over the past few years.
As I warned yesterday, the HIPAA enforcement year is not over. More may be coming from OCR.
For those of you keeping score, this is the 17th Right of Access settlement of 2022 with the total settlement amount for those matters at $859,000. It also marks the 22nd announced enforcement action resolution this year with the total amount of settlements and penalties at $2.17 million.
Stay tuned for my 2022 HIPAA Enforcement summary, which I do every year to provide insight on enforcement trends.