By Laura Dickson Rixey, Health Care

OCR Cracks Down on Healthcare Providers in Right to Access Initiative

“For too long, healthcare providers have slow-walked their duty to provide patients their medical records out of a sleepy bureaucratic inertia. We hope our shift to the imposition of corrective actions and settlements under our Right of Access Initiative will finally wake up healthcare providers to their obligations under the law.” – Roger Severino, OCR Director

Increased Inquiries, Investigations, and Settlements

Over the past year, the Office for Civil Rights (OCR) within the U.S. Department of Health and Human Services (HHS) has dedicated extensive time and resources to reviewing patient complaints against healthcare providers alleging that their right to access their healthcare records was improperly denied or delayed. The purpose of the Right of Access Initiative is to empower individuals to take control of their health and medical decisions by ensuring they have the right to access their medical records in a timely manner and to hold covered entities accountable for failing to provide patients with such access.

To date, HHS has published nineteen settlements under the Right of Access Initiative. The financial penalties in these settlements range from $3,500 to $200,000. In addition to financial penalties, all nineteen settlements have resulted in OCR monitoring of one to two years and the implementation of a tailored corrective action plan.

Our team has regularly assisted our clients in responding to formal OCR inquiries in response to patient complaints alleging they were denied proper access to their medical records. These inquiries nearly always require that the healthcare provider provide the following: (1) a fact-intensive summary, complete with substantiating documentation, with respect to the complainant’s allegations; (2) a copy of the provider’s current HIPAA policies and procedures; and (3) a description of how the provider trains its staff to respond to medical record requests. Responding to these inquiries is often very time-intensive.

Responding to Requests for Access to Health Records

The HIPAA Privacy Rule provides patients with a legally enforceable right to access and obtain a copy of their protected health information (PHI) in their medical records in a timely manner. A covered entity must act on any PHI request within 30 days after receipt. In that timeframe, the covered entity is obligated to either (1) provide the access requested to the appropriate individual, (2) deny the request if permitted by HIPAA, or (3) notify the individual seeking the health information that an extension is needed in accordance with HIPAA.

HHS has clearly stated that this 30-day time frame is an outer limit and that covered entities should be able to respond much quicker than that, particularly when a request is made electronically and the medical records are maintained electronically.

Covered entities must also provide access to the health information in the form specifically requested by the individual. If the PHI is not readily available in the requested format, the entity and the individual will need to mutually agree on another format.

Additionally, providers should be mindful that Virginia law provides similar access rights to patients and certain third parties and that a failure to comply with these state laws could result in disciplinary action being taken by the relevant regulatory board.

Looking Forward and Avoiding Noncompliance

The Right of Access Initiative demonstrates that covered entities must pay close attention to their policies and procedures regarding the Privacy Rule and must promptly and appropriately respond to all requests for medical records. It does not seem likely that this initiative will fade into the background anytime soon. Accordingly, covered entities should be proactive about reviewing their HIPAA policies and procedures and training staff about how to correctly respond to both individual and third party health information requests.

The contents of this publication are intended for general information only and should not be construed as legal advice or a legal opinion on specific facts and circumstances. Copyright 2024.