Providing records to residents, their families, and/or counsel upon request is not only good business, it is required under the Health Insurance Portability and Accountability Act (HIPAA). The Office of Civil Rights (OCR), which enforces HIPAA, settled its first case in its “Right of Access Initiative” on September 9, 2019.

In that case, a provider paid $85,000 as a settlement to OCR and developed a corrective action plan to address the allegation that it violated HIPAA’s right of access by failing to provide timely access to medical records. Allegedly, it took the patient’s complaint to OCR to prompt the provider to finally produce the medical record-nine months after the patient made the initial request. OCR’s Director, Roger Severino announced that OCR “will hold the health care industry accountable for ignoring peoples’ rights to access their medical records.”

Keeping to its promise, OCR settled its second right of access case on December 12, 2019. In this recent settlement the allegation was that the provider failed to timely provide records. Additionally, when the records were provided, they were not produced in the requested electronic format, and charges were imposed that were higher than the reasonably cost-based fees allowed under HIPAA. The patient complained to OCR, which resulted in OCR assisting the provider with its obligations. However, OCR alleged that despite OCR providing technical assistance to the provider, the provider continued to violate HIPAA in failing to produce the requested records. OCR then received a second complaint regarding the same provider. The provider ultimately agreed to take corrective actions and pay $85,000 to OCR for the alleged HIPAA violations.

In another foretelling statement OCR’s Director said he hopes “the imposition of corrective actions and settlements under our Right of Access initiative will finally wake up healthcare providers to their obligations under the law.” What are a provider’s obligations? HIPAA stipulates that “an individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set, for as long as the protected health information is maintained in the designated record set.” 45 CFR § 164.524(a)(1). The timeframe in which to provide access is no later than 30 days after receipt of the request, unless an extension of time is taken pursuant to HIPAA, or an exemption to providing access applies. 45 CFR § 164.524(b)(2).

The Kitch firm helps its clients achieve and maintain HIPAA compliance through the development and implementation of HIPAA Privacy and Security Policies. Should you need assistance with how you handle medical records requests, or if you have any questions or concerns please do not hesitate to contact a member of our Post-Acute Care Practice.

Any information included here or through our web site is presented solely for general informational purposes and is not in any way intended as legal advice, is not a substitute for getting actual legal advice from an attorney, and should not be acted upon as legal advice without first seeking qualified professional counsel specific to your needs and situation. Additionally, by providing this general information and the information on our web site, no attorney client relationship is created.

HIPAA Compliance: Responding to Medical Records Requests

Key Contacts

Related Services