HHS’ Office of Civil Rights has fined yet another provider for failing to deliver patients’ medical records in a timely fashion. The provider, Banner Health, has agreed to take corrective actions and pay $200,000 to settle potential violations of the HIPAA Privacy Rule’s right of access standard. Banner Health is a non-profit health system based in Phoenix, Arizona.
OCR received two complaints filed against Banner Health ACE entities alleging violations of the HIPAA Right of Access standard. The first complaint alleged that the individual requested access to her medical records in December 2017, and did not receive the records until May 2018. The second complaint alleged that the individual requested access to an electronic copy of his records in September 2019, and the records were not sent until February 2020. OCR’s investigations determined that Banner Health ACE entities’ failure to provide timely access to the requested medical records were potential violations of the HIPAA right of access standard.
In addition to the monetary settlement, Banner Health will undertake a corrective action plan that includes two years of monitoring. Read the resolution agreement and corrective action plan by clicking here.
The Right of Access rule “generally requires HIPAA covered entities (health plans and most health care providers) to provide individuals, upon request, with access to the protected health information (PHI) about them in one or more “designated record sets” maintained by or for the covered entity. This includes the right to inspect or obtain a copy, or both, of the PHI, as well as to direct the covered entity to transmit a copy to a designated person or entity of the individual’s choice.”
The OCR has treated the HIPAA Right of Access Initiative as an enforcement priority since 2019, although many “non-essential” enforcement actions have slowed or paused due to the COVID-19 pandemic. While enforcement may be slow in the near future, as the country re-opens enforcement actions will undoubtedly increase.
Although you probably have other issues on your mind as the pandemic continues to rage, now is a good time to remind your staff about HIPAA Right of Access. Don’t let your practice be featured in the next press release from HHS!