HHS Continues to Pursue HIPAA Right of Access Rule Violators.

Posted on by

HHS’ Office of Civil Rights has fined yet another provider for failing to deliver a patient’s medical records in a timely fashion. From the latest HHS press release:

“The Diabetes, Endocrinology & Lipidology Center, Inc. (“DELC”) has agreed to take corrective actions and pay $5,000 to settle a potential violation of the HIPAA Privacy Rule’s right of access standard.  DELC is a West Virginia based healthcare provider that provides treatment for Endocrine disorders.”

“In early August 2019, a complaint was filed with OCR alleging that DELC failed to take timely action in response to a parent’s records access request made in July 2019, for a copy of her minor child’s protected health information. OCR initiated an investigation and determined that DELC’s failure to provide timely access to the requested medical records was a potential violation of the HIPAA right of access standard.  As a result of OCR’s investigation, DELC provided the requested records in May 2021, nearly two years after the parent’s request.”

The Right of Access rule “generally requires HIPAA covered entities (health plans and most health care providers) to provide individuals, upon request, with access to the protected health information (PHI) about them in one or more “designated record sets” maintained by or for the covered entity. This includes the right to inspect or obtain a copy, or both, of the PHI, as well as to direct the covered entity to transmit a copy to a designated person or entity of the individual’s choice.”

The OCR has treated the HIPAA Right of Access Initiative as an enforcement priority since 2019, although many “non-essential” enforcement actions have slowed or paused due to the COVID-19 pandemic. While enforcement may be slow in the near future, as the country re-opens enforcement actions will undoubtedly increase.

Although you probably have other issues on your mind, now is a good time to remind your staff about HIPAA Right of Access. Do you really want to pay a $5,000 fine because you failed to provide a patient’s medical records? A few minutes of effort can save you from being the target of a Federal investigation. Don’t let your practice be featured in the next press release from HHS!