Less than a month after announcing five right of access enforcement action resolutions in one day, the Office for Civil Rights (OCR) announced two more last week.
The first, on October 7, 2020 involved a large Arizona-based hospital and medical center, which agreed to pay $160,000 to settle claims that it violated the right of access provision under the HIPAA Privacy Rule. Like the earlier enforcement actions, a complaint triggered OCR’s involvement. A mother requested copies of her minor son’s medical records on several occasions, but the provider failed to give the mother copies of all the records. The mother filed a complaint on April 25, 2018.
The second announced enforcement action resolution last week came on October 9, 2020. A neurology and pain management provider with offices in New York and Florida agreed to pay $100,000 to settle claims that it failed to adhere to the right of access requirements. In July 2019, a patient complained to OCR that she made numerous requests for a complete copy of her records, including copies of X-ray, MRI and CT scan images. The provider did not give the patient copies of the diagnostic films.
According to OCR, it attempted to reach the provider via mail (including certified mail) beginning in October 2019 and then via telephone beginning in December 2019. It did not receive a return call until March 6, 2020, after OCR’s third message. Make no mistake about it, the provider’s delayed response to OCR was a driving factor in the six-figure settlement amount.
These two actions bring the total number of right of access settlements in 2020 to seven and the total since the right of access enforcement initiative began last year to nine. As with all the other right of access enforcement actions, OCR continues to move quickly on patient right of access complaints and enforcement.
For more on the right of access provision and the importance of compliance, see my post from September entitled OCR’s HIPAA Right of Access Enforcement Initiative Heats Up.
And, for those of you keeping score, the total number of HIPAA enforcement resolutions announced so far in 2020 is 13 with a total amount of those actions at just over $12 million.