A patient’s uphill battle to get a copy of her medical records has led to another resolution agreement between a covered entity (CE) and the HHS Office for Civil Rights (OCR), which says the case is a first under its new Right of Access Initiative.
Bayfront Health St. Petersburg in Florida paid $85,000 to OCR and adopted a corrective action plan to settle a potential violation of HIPAA’s right of access provision, which requires CEs to give patients their records within 30 days. OCR alleged that Bayfront, a Level II trauma and tertiary care center, didn’t provide a mother timely access to records about her unborn child. The mom complained to OCR, which had to shake the records loose from Bayfront nine months after she made her first request.
A patient’s right to access his or her records is a cornerstone of the HIPAA Privacy Rule, and OCR imposed its first civil monetary penalty ever in a case about violating it. In 2011, Cignet Health of Prince George’s County, Maryland, paid $4.3 million for violating 41 patients’ rights by denying their access to medical records. They separately requested them in vain and individually filed complaints with OCR, which investigated. “During the investigations, Cignet refused to respond to OCR’s repeated demands to produce the records,” OCR said. “On April 7, 2010, Cignet produced the medical records to OCR, but otherwise made no efforts to resolve the complaints through informal means.”
The Cignet and Bayfront cases aside, CEs generally seem to have the patient-access requirement under control, some experts say. “I don’t think there’s widespread noncompliance with this requirement,” says former OCR acting deputy director Iliana Peters, who was also senior advisor for HIPAA compliance and enforcement. But there are “areas of potential noncompliance” and some confusion about the right of access, particularly with respect to the judicial and administrative process, says Peters, with Polsinelli in Washington, D.C. She predicts clarity will come through enforcement. There’s also controversy around charges, which is at the heart of a lawsuit against HHS.
