By Lee Slaton, Vice President of Healthcare; Smart Training“And the hits just keep on coming!”1 Last month, The Department of Health and Human Services’ Office for Civil Rights (OCR) imposed its twentieth financial penalty under the Health Insurance Portability and Accountability Act’s (HIPAA) Right of Access enforcement initiative launched in late 2019.
A pediatric care provider in Omaha, Nebraska, was ordered to pay a penalty of $80,000 to resolve the alleged Right of Access violation. The provider is also required to adopt a corrective action plan to address the noncompliance discovered by OCR and will be monitored for compliance for one year.
You have 30 days to provide patients records.
As we’ve reviewed in several of my articles, the HIPAA Privacy Rule gave individuals the right to obtain a copy of their protected health information held by a HIPAA covered entity, and for parents and legal guardians to obtain a copy of the medical records of their minor children. HIPAA covered entities must provide the requested records within 30 days and are only permitted to charge a reasonable cost-based fee for providing copies. HIPAA also requires covered entities to give parents timely access to their minor children’s medical records when the parent is the child’s personal representative. In certain circumstances, covered entities can apply for a 30-day extension.
Patients can file complaints through OCR.
Individuals can’t take legal action against a HIPAA-covered entity for a HIPAA violation, but they can file a complaint with OCR. In this case, OCR received a complaint from a parent who alleged the provider hadn’t given timely access to her minor daughter’s medical records. Specifically, the provider received the parent’s request and provided some, but not all, of her daughter’s medical records. The parent made several follow-up attempts to receive the requested information. OCR confirmed the mother’s requests for a copy of her late daughter’s medical records in writing on January 3, 2020. Some of the requested records were provided; however, the remainder of the records weren’t provided until June 30 and July 16.
Perhaps by now there’s a nagging doubt beginning to creep into the back of your mind as to how well prepared your office is to deal with Right of Access requests. Judging from the OCR’s dogged persistence in following up on these complaints, it isn’t going to back off its enhanced enforcement of this issue until more providers sit up, take notice, and address the problem.
1“And the Hits Just Keep on Comin'” is an album by Michael Nesmith.