In October 2020, and again on November 6, 2020, the U.S. Department of Health and Human Services, Office for Civil Rights (OCR) took another step in its HIPAA Right of Access Initiative. In these actions, OCR entered into settlements with clinical practices for failure to provide patients with copies of their medical records.
In OCR’s ninth settlement under the initiative, NY Spine Medicine, a neurology and pain management physician practice in New York and Florida, paid a $100,000 settlement and entered into a corrective action plan for an alleged failure to provide an individual with access to all of her records. The individual filed a complaint with OCR in July 2019, alleging that she repeatedly requested a copy of her medical records from NY Spine Medicine. The individual detailed that NY Spine Medicine provided some of the requested information, but not the X-ray, MRI, and CT scans that she specifically requested. OCR’s investigation determined that the practice’s failure to provide the individual with timely access to her records potentially violated the HIPAA right of access standard. Following the OCR investigation, the individual received the remainder of her records in October 2020.
OCR’s November settlement also followed a complaint from an individual that she was not provided with a copy of her medical record after multiple requests. Riverside Psychiatric Medical Group (Riverside), a group practice focused on psychiatry, psychology, and substance use disorder treatment, defended its access denial, responding that the patient’s records contained psychotherapy notes. While HIPAA does not require a covered entity to provide access to psychotherapy notes, it does require access to the remainder of the medical record, and it does require a practice to provide the individual with an explanation of the reason for the denial. While the individual received the portion of her records to which she was entitled in October 2020, citing Riverside’s failure to provide both timely access and an explanation of the partial denial, the OCR settlement requires Riverside to pay a $25,000 financial settlement and comply with a corrective action plan.
A notable element of both of these enforcement actions is that both practices experienced issues cooperating with OCR. NY Spine Medicine only responded to OCR’s investigation after multiple forms of outreach to the practice over a five-month period. With respect to the Riverside investigation, OCR initially provided Riverside with technical assistance on how to comply with HIPAA with respect to the individual’s request for access. Following a second complaint from the individual after access still was not provided, OCR and the practice entered into the settlement agreement.
From the largest health systems to the smallest clinician practices, HIPAA covered entities should ensure that their workforce understands patients’ rights to access their health information. Covered entities should have a system in place to respond to access requests, with an emphasis on a timely and complete response. Denials of access should follow a process strictly aligned with the HIPAA regulations, which should always include proper notice to the requesting individual. In addition to properly fulfilling access requests, training workforce members involved in the provision of access to medical records and documenting such training, is an important compliance consideration to allow covered entities to demonstrate adherence to the HIPAA right of access standard.