The steady stream of resolution agreements between providers and the HHS Office for Civil Rights (OCR) for failures to provide patients their medical records might strike some as overkill. As of the end of March, there were 18 such settlements, which collectively brought OCR $918,500. But because OCR is 10 years late drafting a regulation for sharing penalties, none of that money went to the individuals who struggled to get their protected health information (PHI).
OCR embarked on its “Right of Access Initiative” in September 2019 with an $85,000 settlement with Bayfront Health of St. Petersburg, Florida. It ended March with two new settlements announced days apart: Village Plastic Surgery (VPS) in New Jersey paid $30,000 and agreed to a one-year corrective action plan,[1] while the price for a behavioral health system in Massachusetts was $65,000 and a one-year CAP.[2]
But at least one health care attorney says bring ‘em on.
“I don’t think 18 is too many; I don’t think 100 is too many,” Jeff Drummond, partner with Jackson Walker LLP in Dallas, told RPP. “I’m actually quite glad to see OCR taking an approach like this. I’ve always felt that OCR’s enforcement strategy has been deeply flawed.”
Drummond takes the position that OCR’s approach should be to have “a couple thousand enforcement actions that result in $10,000 penalties [rather] than the handful of multimillion-dollar ones. Having a few super-big-dollar cases is a good thing, don’t get me wrong, and I do like the fact that OCR doesn’t levy fines if the covered entity responds properly and respectfully,” he said. Yet, “there just needs to be some more gentle nudging so that people learn their lessons.”
One Complaint Triggered Enforcement
Like other such settlements, the 18th announced March 26 shows that a covered entity may face an enforcement action based on a single complaint. Also of note, in this case, the patient submitted a complaint just one month after requesting the records, and OCR, unlike other settlements, doesn’t seem to have provided any technical assistance before moving to a settlement.
OCR received a complaint in September 2019 that VPS “failed to take timely action in response to a patient’s records access request made in August 2019.” After OCR’s investigation, “VPS sent the patient their requested records.”[3]
Under the CAP, VPS is required to revise its policies and procedures for records access, submit them to OCR for approval, and retrain workers on any new ones. One unusual requirement is that every 90 days during the CAP, VPS must send HHS a list of how it handled access requests along with “the date request received, date request completed, format requested, format provided, number of pages (if provided in paper format), and cost, excluding postage.” This requirement was also part of the CAP for Housing Works Inc., which settled its access investigation with OCR for $38,000 in June.[4]
The settlement OCR had announced two days earlier with a behavioral health provider shared more in common with other cases. According to OCR, Arbour Hospital of Massachusetts received a records request in May 2019, prompting a complaint in July of that year to OCR.[5]
That month OCR “provided technical assistance regarding an individual’s right of access to protected health information and closed the complaint,” but six days later, the individual filed a second complaint because the records were still not provided. It is not required to provide periodic updates of its access requests. Both VPS and Arbour must file annual reports during the CAP period describing any possible violations of the access requirements and how they were addressed.
