Printer Friendly, PDF & Email

New Settlement Shows a Return To Enforcement, Security Basics

Remember a time before the HHS Office for Civil Rights (OCR) decided to make patients’ access to medical records a priority?

With its 19th settlement under its belt just last month, those who may be caught up in OCR’s medical records focus could be forgiven: the agency has settled with a record number of covered entities (CEs) for a single issue.

In 2018, then OCR Director Roger Severino launched the agency’s Right of Access Initiative, with a steady drumbeat of settlements to follow. Six of this year’s eight settlements are part of that effort—and on June 2, OCR announced yet another agreement with a CE over this issue, for $5,000 with an endocrinology practice in West Virginia.[1]

But there also was a nonaccess settlement in May for $25,000 with Peachstate Health Management LLC,[2] and it differs from the first 2021 OCR security rule agreement in more than just financial terms.

The year started off with a whopper of a settlement—New York-based Excellus Health Plan Inc. agreed to pay $5.1 million and implement a two-year corrective action plan (CAP) related to the discovery in 2015 of a hacking in 2013 that exposed the protected health information (PHI) of 9.3 million individuals.[3]

Announced May 25, Peachstate’s settlement, unlike many OCR agreements, calls for the firm to hire an external monitor to ensure its compliance with a three-year CAP, a year longer than the term the agency has imposed in the majority of cases in the recent past.

This document is only available to subscribers. Please log in or purchase access.