◆ The HHS Office for Civil Rights (OCR) said Aug. 1 it has collected a $115,200 civil monetary penalty (CMP) from American Medical Response (AMR), a national provider of emergency medical services.[1] The CMP stemmed from OCR’s investigation of a complaint that AMR didn’t give a patient timely access to her medical records. The HIPAA Privacy Rule’s right of access provision requires covered entities to give people or their personal representatives access to their health information within 30 days, with the possibility of one 30-day extension, for a reasonable, cost-based fee. According to OCR’s Notice of Proposed Determination, the patient on Oct. 31, 2018, faxed AMR a request for her medical records, including “all billing records pertaining to treatment rendered for 9/15/2015 injury date; Patient Balance Verification; all medical records pertaining to treatment rendered for 9/15/2015 injury date.” The patient didn’t get her records until OCR had opened an investigation, and they allegedly arrived 370 days after her initial request. OCR said, “AMR waived its right to a hearing and did not contest OCR’s findings” and OCR finalized the penalty.