By Lee Slaton, Vice President of Healthcare; Smart TrainingWith the announcement of 11 additional financial penalties for HIPAA-covered entities failing to provide patients with timely access to their medical records, the Department of Health and Human Services’ Office for Civil Rights (OCR) is becoming a bit of a broken record with its warnings to healthcare providers on the importance of compliance with HIPAA Right of Access. This latest batch of enforcement actions brings the number of financial penalties imposed under the HIPAA Right of Access enforcement initiative to 38.
OCR launched the enforcement initiative in the fall of 2019 in response to reports of widespread noncompliance with this important HIPAA right. It gives people the right to inspect their protected health information held by a HIPAA-covered entity, check the information for errors, and request any errors be corrected. People can also request a copy of their protected health information from healthcare providers and health plans. Requests can be submitted by a patient’s nominated representatives; or parents and legal guardians, if the patient is a minor.
When such a request is made, the information must be provided in full within 30 days of receipt of the request. In very limited circumstances, an extension of 30 days is allowed. Any individual requesting a copy of their records can only be charged a reasonable, cost-based fee for obtaining a copy of their records. The records should be provided in the format requested by the patient, provided the HIPAA-covered entity has the technical capability to provide records in that format.
In this space, I recently documented several of these Right of Access violations. Notably in this latest tranche are a couple of Texas-based providers: Memorial Hermann Health System, which paid $240,000 to settle a complaint from a patient who waited over 563 days to receive their complete request; and Southwest Surgical Associates, which paid $65,000 to settle a complaint from a patient that waited 13 months to receive their records.
Bottom line: If you’re a healthcare provider and have lots of cash to burn, you have the option of dawdling when addressing a patient’s record request. Otherwise, take heed—it’s obvious the OCR isn’t fooling around in addressing patient complaints regarding not receiving their records in a timely manner.