In early 2019 the Office for Civil Rights (OCR) created the Right of Access Initiative in which it vowed to make the investigation and enforcement of right of access complaints one of its primary focuses. Since then, OCR has not wavered in that vow.
“Providing patients with their health information not only lowers costs and leads to better health outcomes, but it’s also the law. We aim to hold the health care industry accountable for ignoring peoples’ rights to access their medical records and those of their kids,” said OCR Director Roger Severino in 2019.
The Right of Access
The right of a patient, or authorized representative, to access their medical records promptly is one of the most valuable protections of the HIPAA Privacy Rule. This also applies to former patients for an amount of time since their last visit, the length of which can vary by State.
The HHS defines a “timely manner” as providing any requested information within 30 days of receiving the request unless there is a valid reason why it cannot be provided so quickly. If there is a valid reason, such as the information being stored in a way that’s not readily available, the covered entity would need to provide a written explanation. It would only be granted one 30-day extension. Many States have right-of-access provisions that shorten that deadline. And in addition, the HHS are currently considering regulations that would cut the 30-day deadline in half.
The first week of the 2023 new year also brought the first HIPAA settlement and showed that the OCR has no intention of slowing down in its right of access enforcement.
LifeHope Labs, based in Georgia, agreed to a $16,500 settlement and to implement a corrective action plan to resolve the OCR’s investigation. The corrective action plan includes two years of close OCR monitoring. The complaint, dating back to August 24, 2021, was filed by the legal representative of a deceased patient’s estate. It alleged that there was a lengthy delay in getting access to the patient’s medical records. The initial request for the records was made in July 2021 but was not fulfilled until February 16, 2022.
This case marks the 43rd associated with the OCR’s enforcement initiative and the 3rd over the last 30 days. On Dec 20, 2022, the OCR announced a $20,000 settlement with a primary care provider, Health Specialists of Central Florida. The settlements have ranged from $3,500 to over $200,000 and have affected a range of HIPAA-covered entities, from small dental practices to large hospitals.
As the last few years have shown, any covered entity that fails to follow this will be thoroughly investigated and could face significant penalties and governmental oversight. The best practice is to treat every patient request with the same care and attention that you treat every patient’s health.
Get Paid Quickly, Easily, and Safely with Practice Management Bridge
At Rectangle Health, we understand the importance of providing efficient and effective healthcare services. That’s why we’ve created our platform, Practice Management Bridge, which streamlines the payment and financing process for patients and providers. Our patient engagement tools, including digital communication and appointment scheduling, keep everyone connected and informed. And our commitment to compliance ensures that all patient data is kept private and secure. With our platform, you can focus on what matters most: providing quality care to your patients. Don’t wait! Schedule a demo now and see how we can help you improve patient engagement, compliance, and communication while streamlining payments and financing.
References:
- HHS Right of Access Standard – https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html
- LifeHope Labs Resolution Agreement – https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/life-hopes-ra-cap/index.html
- 1st Settlement and OCR Director Quote – https://www.agg.com/news-insights/publications/ocrs-first-hipaa-right-of-access-enforcement-action/
- Health Specialists of Central Florida Resolution Agreement – https://www.healthcarefinancenews.com/news/hhs-office-civil-rights-settles-hipaa-access-investigation-20k-settlement
- Resolution Agreements – https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
