OCR-HIPAA Right of Access Initiative

OCR-HIPAA

Right of Access Initiative

BY MICHAEL R. LOWE, BRIAN C. EVANDER AND SARA D. MCLAUGHLIN

In early 2019, the Office for Civil Rights (OCR) commenced its Right of Access Initiative, an enforcement priority to support individuals’ right to timely access to their health records at a reasonable cost.

This article is the first in a 2-part email blast series examining the implications and key takeaways from the OCR’s Right to Access Initiative.

On September 9, 2019, the OCR sent out a press release that they settled the first case in Health Insurance Portability and Accountability Act (HIPAA) Right of Access Initiative. This settlement was with Bayfront Health St. Petersburg (Bayfront) in Florida and consisted of a $85,000 fine and a corrective action plan. This complaint was sent to OCR by a mother who Bayfront failed to provide timely access to medical records concerning her unborn child. The HIPAA access rule (45 CFR 164.524) generally requires covered entities to provide medical records requested by a patient within 30 days of the request and extends to parents requesting information about their minor children. Applicable Florida medical records laws generally require a “timely” response to a request for access or copies of records and medical information without defining a specific amount of time for a health care provider to respond and/or allow access.

In the announcement, OCR Director Roger Severino stated, “Providing patients with their health information not only lowers costs and leads to better health outcomes, it’s the law.” Mr. Severino reiterated the promise to enforce compliance with these rules, asserting, “We aim to hold the health care industry accountable for ignoring peoples’ rights to access their medical records and those of their kids.”

Since September 2019, the OCR has successfully settled fourteen (14) cases to date, with the five (5) most recent settlements taking place since November of 2020. On November 6, 2020, the OCR sent out a press release that they settled the tenth case. This settlement was with Riverside Psychiatric Medical Group (RPMG) based in Riverside, California. In March of 2019, OCR received a complaint from a patient alleging that RPMG failed to provide a copy of medical records despite multiple requests. According to the press statement, RPMG claimed that because the requested records included psychotherapy notes, they did not have to comply with the access request. While the HIPAA Rules do not require production of psychotherapy notes, they do require covered entities to provide: (1) requestors a written explanation when it denies any records request in whole or in part (which RPMG did not do), and (2) the individual access to his or her medical records other than psychotherapy notes (and information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding). In October of 2020, RPMG provided the patient all of the requested medical record information, excluding psychotherapy notes. RPMG agreed to take corrective action with two years of monitoring and pay a $25,000 fine.

On November 12, 2020, the OCR sent out a press release regarding the settlement of the eleventh case. This case involved Dr. Rajendra Bhayani, who is a private practitioner specializing in otolaryngology in Regal Park, New York and a complaint the OCR received in September of 2018 from a patient alleging that Dr. Bhayani failed to provide the patient with access to the patient’s medical records. And after the OCR’s investigation, the complainant received a complete copy of the requested medical records in September 2020. In the settlement, Dr. Bhayani agreed to take corrective actions with a corrective action plan along with two years of monitoring and pay a $15,000 fine. In the press release, OCR Director Roger Severino stated, “Doctor’s offices, large and small, must provide patients their medical records in a timely fashion. We will continue to prioritize HIPAA Right of Access cases for enforcement until providers get the message.”

On November 19, 2020, the OCR sent out a press release on the settlement regarding the twelfth case. This case involved the University of Cincinnati Medical Center, LLC (UCMC) and a patient complaint from May of 2019 alleging that UCMC failed to respond to a records access request directing UCMC to provide electronic health records to the patient’s attorney. In this case the OCR determined that UCMC failed to timely provide a copy of the requested medical records in potential violation of the HIPAA Rules, which include the right of patients to have electronic copies of records in an EHR transmitted directly to a third party. “OCR is committed to enforcing patients’ right to access their medical records, including the right to direct electronic copies to a third party of their choice. HIPAA covered entities should review their policies and training programs to ensure they know and can fulfill all their HIPAA obligations whenever a patient seeks access to his or her records,” said Roger Severino, OCR Director. UCMC has agreed to pay a $65,000 fine and undertake a corrective action plan that includes two years of monitoring.

On December 22, 2020, the OCR sent out a press release on the recent settlement regarding the thirteenth case. This case involved Peter Wrobel, M.D., P.C.,

CONTINUED P.12