As we mentioned in a previous article, the Office for Civil Rights (OCR) will continue to make the Right of Access Initiative a priority. According to a recent announcement, OCR has settled its twelfth enforcement action in its HIPAA Right of Access Initiative.
This most recent HIPAA Right of Access Settlement resulted in an academic medical center agreeing to take corrective actions and pay $65,000 to settle a potential violation of the HIPAA Privacy Rule's right of access standard.
OCR received a complaint alleging the academic medical center failed to respond to a patient's records access request directing them to send an electronic copy of her medical records maintained in their electronic health record (EHR) to her lawyers. According to the OCR, based on their investigation, they determined the academic center failed to timely provide a copy of the requested medical records in potential violation of the HIPAA Rules, which include the right of patients to have electronic copies of records in an EHR transmitted directly to a third party. As a result of OCR's investigation and intervention, the complainant, received all of the requested medical records in August 2019.
OCR is committed to enforcing patients' right to access their medical records, including the right to direct electronic copies to a third party of their choice. HIPAA-covered entities should review their policies and training programs to ensure they know and can fulfill all their HIPAA obligations whenever a patient seeks access to his or her records," said Roger Severino, OCR Director.
Reminder on Importance of Individuals' Right of Access to Health Records
Remember earlier this year when a Federal court vacated the "third-party directive" within the
individual right of access "insofar as it expands the HITECH Act's third-party
directive beyond requests for a copy of an electronic health record with
respect to [protected health information] of an individual . . . in an
electronic format?" In OCR's
announcement, they mentioned the right of individuals to access their own
records and the fee limitations that apply when exercising this right are
undisturbed and remain in effect. And, OCR will continue to enforce the
right of access provisions in 45 C.F.R. 164.524 that are not restricted by
the court order. Their most recent HIPAA Right of Access settlement is an
important reminder for healthcare organizations.