OCR HIPAA Right of Access to Medical Records Cases

Continuing its critical march in opposition to coated entities not permitting sufferers entry to their data, the Office for Civil Rights (OCR) has settled two extra circumstances in two days in its Right of Access Initiative. This brings the tally of OCR’s settlements to a complete of 18.

The seventeenth settlement, with The Arbour, Inc., d/b/a Arbour Hospital (Arbour,), was introduced by the OCR on March 24, 2021. The settlement features a fee of $65,000 and an settlement to enter right into a corrective motion plan. In that case, the OCR acquired a grievance in July of 2019 from a affected person who alleged that Arbour failed to present the affected person with a replica of the affected person’s data.  The request was acquired by Arbour  in May of 2019.

The OCR supplied technical help to Arbour, however then acquired a second grievance from the affected person that Arbour nonetheless had not supplied the affected person with the data.

The affected person didn’t obtain the data till November of 2019. OCR decided “that Arbour’s failure to present well timed entry to the requested medical data was a possible violation of the HIPAA proper of entry normal, which requires a coated entity to take motion on an entry request inside 30 days of receipt (or inside 60 days if an extension is relevant.)” In this case, Arbour didn’t present the affected person with the data for greater than 5 months after the request.

Two days later, on March 26, 2021, the OCR introduced it had accomplished its 18th investigation within the HIPAA Right of Access Initiative when it settled with Village Plastic Surgery (VPS). That settlement included a fee of $30,000 and an settlement to enter right into a corrective motion plan.

That investigation began after a affected person complained in September of 2019 that VPS failed to reply in a well timed method to the affected person’s request made in August of 2019. The OCR initiated its investigation and “decided that VPS’s failure to present well timed entry to the requested medical data was a possible violation of the HIPAA proper of entry normal” as a result of VPS didn’t present the affected person with the data inside 30 days. According to the OCR’s press launch, “OCR’s Right of Access Initiative continues to assist and implement people’ very important proper to obtain copies of their medical data in a well timed method.”

As with most OCR settlements, these present a stark reminder that coated entities might need to revisit processes in place to present medical data to sufferers when they’re requested, so the requests are responded to in a well timed method.