After a four-month pause, the HHS Office for Civil Rights (OCR) resumed in its nearly three-year drive to hold health care organizations accountable for compliance with the HIPAA Privacy Rule’s foundational right of access provision.

OCR unveiled 11 Right of Access Initiative enforcement actions on July 15, with settlement amounts ranging from $3,500 to $240,000.^[1] OCR also imposed a civil monetary penalty (CMP) of $100,000 on one organization. The spate of enforcement indicates OCR will continue to prioritize access, one attorney said.

“These are pretty easy for OCR to pursue, since it’s pretty much a slam dunk to prove,” said Jeff Drummond, a partner with Jackson Walker LLP in Dallas. “There’s not a whole lot of gray, nor are there a lot of reasons to deny a patient access to his/her records. And I like the way OCR is doing this—a lot of cases with generally small fines. This is different than most of the OCR non-access settlements; there aren’t that many of them, but they all have really large fines. I think you get better compliance with many smaller fines than you do with very few but very large fines.”

Drummond told RPP his clients are paying more attention to the right of access and “are hyper-focused on providing access when asked.” Providers need to be aware of HIPAA’s access rules but also need to follow the 21^st Century Cures Act with respect to their electronic medical records (EMRs), he said. “While HIPAA gives a provider 30 days, the Cures Act generally requires access be given to EMR records within 24 hours.”

OCR began enforcement actions related to problems patients were encountering receiving their records in 2019, under then-OCR Director Roger Severino.

The new settlements cover a retina practice; a dental practice; an ear, nose and throat specialist; a public benefit corporation that operates a hospital; and a nursing and rehabilitation center. The largest settlement was with Memorial Hermann Health System (MHHS), a not-for-profit health system in Texas.

OCR issued a notice of final determination and imposed a CMP of $100,000 against ACPM Podiatry, a practice with offices in Peoria and Canton, Illinois.

The notice of proposed determination,^[2] sent July 13, 2021, to ACPM, and the notice of final determination, sent April 5,^[3] detail the complaint against the organization and the efforts OCR took to prompt compliance with the access standard before it applied a CMP.