On June 2, 2021, the U.S. Department of Health and Human Services, Office for Civil Rights (OCR) announced its nineteenth settlement in its HIPAA Right of Access Initiative. This Initiative emphasizes the right provided by the HIPAA Privacy Rule allowing individuals to receive timely access to their medical records at a reasonable cost.
The Diabetes, Endocrinology & Lipidology Center, Inc. (“DELC”), a West Virginia health care provider specializing in the treatment of endocrine disorders, paid a $5,000 settlement and entered into a two-year Corrective Action Plan. The enforcement action was based on an August 2019 complaint from a parent, stating that DELC failed to provide her with timely access to her minor child’s protected health information. OCR investigated, and found that, similar to a prior Right of Access Initiative settlement addressing a parent’s request for records, the failure to provide timely access was a potential violation of the HIPAA right of access requirement. DELC eventually provided the records to the parent, nearly two years after the initial request.
As DELC is not a multi-facility health care system, and the financial penalty involved is small in comparison to most other OCR settlements, this Right of Access Initiative settlement serves as a reminder to health care providers of all sizes to comply with the HIPAA Privacy Rule’s access requirements. Providers should take care to properly address patient (and parent/personal representative) access requests, and ensure that any response delays or denials are permitted under the Privacy Rule.