OCR Announces First Settlement in the HIPAA Right of Access Initiative.
The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) recently announced the first enforcement action and settlement pursuant to its Right of Access Initiative. OCR publicized the initiative earlier this year, and it is aimed at enforcing patients’ rights to promptly receive copies of their medical records and to do so without being overcharged. In this matter, OCR enforced this right against Bayfront Health St. Petersburg (Bayfront), a Level II trauma and tertiary care center located in St. Petersburg, Florida. Bayfront allegedly violated the Health Insurance Portability and Accountability Act of 1996 (HIPAA) right of access provision when it failed to provide timely medical record access to a mother regarding her unborn child. The mother filed a complaint with OCR, whose investigation found that Bayfront took over nine months after the initial request to provide her with the records. HIPAA generally requires covered entities to provide medical records within 30 days of the request and a covered entity can only charge a reasonable cost-based fee. The HIPAA right to access for patient records extends to parents seeking medical information about their minor children, including prenatal health records.
Bayfront agreed to pay OCR $85,000 and adopt a corrective action plan to settle the potential HIPAA violation. The corrective action plan requires Bayfront to update and implement policies and procedures regarding the right of access, administer training to its workforce about patient’s HIPAA access rights, provide an implementation report and an annual report to OCR, and provide OCR with a list of their business associates that are involved in fulfilling medical record access requests, along with applicable business associate agreements.
The HHS press release is available at: