The HHS Office for Civil Rights (OCR) concluded 2021 with 14 enforcement actions—nearly all of them related to denial of patients’ medical records—and with a new director firmly ensconced to lead the agency. The amount OCR collected last year was close to $6 million, among its lower totals in recent memory, but it expanded the type of organization sanctioned and, for the first time in many years, applied a fine in lieu of a settlement with a noncompliant physician.
Among other highlights, Lisa Pino was appointed OCR director in September, after nearly an eight-month vacancy. Former Director Roger Severino, like others in this top post, was a political appointee and required to resign under a new administration. He did so on Jan. 14, 2021.
OCR’s first settlement of the year was also its largest—$5.1 million with Excellus Health Plan Inc., related to a breach that was discovered in 2015 but dated back to 2013 and affected 9.3 million people. Announced Jan. 15, the settlement was the final one released under Severino’s watch (although, as noted, he had technically resigned a day earlier).
Despite the vacancy, OCR continued in 2021 to churn out medical records settlements; Severino previously told RPP more were in the works at the end of his tenure. There are now a total of 25.
OCR’s last HIPAA enforcement cases of the year came in late November when Pino announced a quintet of medical records access actions at the same time. Four were more typical settlements with amounts ranging from $10,000 to $160,000, accompanied by corrective action plans (CAPs) from one to two years. OCR expanded the type of organization it has historically sanctioned to include an eating disorders treatment center. It was this center that agreed to the highest payment of the five.
The access initiative was Severino’s signature program. Pino has not yet stated publicly whether she has specific enforcement goals.