By Michael R. Lowe, Brian C. Evander and Sara D. McLaughlin
In early 2019, the Office for Civil Rights (OCR) commenced its Right of Access Initiative, an enforcement priority to support individuals’ right to timely access to their health records at a reasonable cost. This article is the first in a 2-part email blast series examining the implications and key takeaways from the OCR’s Right to Access Initiative.
On September 9, 2019, the OCR sent out a press release that they settled the first case in Health Insurance Portability and Accountability Act (HIPAA) Right of Access Initiative. This settlement was with Bayfront Health St. Petersburg (Bayfront) in Florida and consisted of a $85,000 fine and a corrective action plan. This complaint was sent to OCR by a mother who Bayfront failed to provide timely access to medical records concerning her unborn child. The HIPAA access rule (45 CFR 164.524) generally requires covered entities to provide medical records requested by a patient within 30 days of the request and extends to parents requesting information about their minor children. Applicable Florida medical records laws generally require a “timely” response to a request for access or copies of records and medical information without defining a specific amount of time for a health care provider to respond and/or allow access.
In the announcement, OCR Director Roger Severino stated, “Providing patients with their health information not only lowers costs and leads to better health outcomes, it’s the law.” Mr. Severino reiterated the promise to enforce compliance with these rules, asserting, “We aim to hold the health care industry accountable for ignoring peoples’ rights to access their medical records and those of their kids.”
Since September 2019, the OCR has successfully settled fourteen (14) cases to date, with the five (5) most recent settlements taking place since November of 2020. On November 6, 2020, the OCR sent out a press release that they settled the tenth case. This settlement was with Riverside Psychiatric Medical Group (RPMG) based in Riverside, California. In March of 2019, OCR received a complaint from a patient alleging that RPMG failed to provide a copy of medical records despite multiple requests. According to the press statement, RPMG claimed that because the requested records included psychotherapy notes, they did not have to comply with the access request. While the HIPAA Rules do not require production of psychotherapy notes, they do require covered entities to provide: (1) requestors a written explanation when it denies any records request in whole or in part (which RPMG did not do), and (2) the individual access to his or her medical records other than psychotherapy notes (and information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding). In October of 2020, RPMG provided the patient all of the requested medical record information, excluding psychotherapy notes. RPMG agreed to take corrective action with two years of monitoring and pay a $25,000 fine.
On November 12, 2020, the OCR sent out a press release regarding the settlement of the eleventh case. This case involved Dr. Rajendra Bhayani, who is a private practitioner specializing in otolaryngology in Regal Park, New York and a complaint the OCR received in September of 2018 from a patient alleging that Dr. Bhayani failed to provide the patient with access to the patient’s medical records. And after the OCR’s investigation, the complainant received a complete copy of the requested medical records in September 2020. In the settlement, Dr. Bhayani agreed to take corrective actions with a corrective action plan along with two years of monitoring and pay a $15,000 fine. In the press release, OCR Director Roger Severino stated, “Doctor’s offices, large and small, must provide patients their medical records in a timely fashion. We will continue to prioritize HIPAA Right of Access cases for enforcement until providers get the message.”
On November 19, 2020, the OCR sent out a press release on the settlement regarding the twelfth case. This case involved the University of Cincinnati Medical Center, LLC (UCMC) and a patient complaint from May of 2019 alleging that UCMC failed to respond to a records access request directing UCMC to provide electronic health records to the patient’s attorney. In this case the OCR determined that UCMC failed to timely provide a copy of the requested medical records in potential violation of the HIPAA Rules, which include the right of patients to have electronic copies of records in an EHR transmitted directly to a third party. “OCR is committed to enforcing patients’ right to access their medical records, including the right to direct electronic copies to a third party of their choice. HIPAA covered entities should review their policies and training programs to ensure they know and can fulfill all their HIPAA obligations whenever a patient seeks access to his or her records,” said Roger Severino, OCR Director. UCMC has agreed to pay a $65,000 fine and undertake a corrective action plan that includes two years of monitoring.
On December 22, 2020, the OCR sent out a press release on the recent settlement regarding the thirteenth case. This case involved Peter Wrobel, M.D., P.C., d/b/a, Elite Primary Care (Elite), providing primary care services in Georgia and a complaint by a patient claiming that Elite failed to respond to request for access to the patient’s medical records. Elite has greed to pay a $36,000 fine and undertake a corrective action plan including two years of monitoring.
Finally, on January 12, 2021, the OCR sent out a press release on the most recent settlement to date regarding the fourteenth case. The case involved Banner Health, a nonprofit health system based in Phoenix, AZ that operates 30 hospitals and numerous other health care facilities, and two (2) separate complaints to the OCR from individuals alleging Banner Health affiliated entities failed to provide timely access to their medical records. Ultimately, Banner Health settled and will pay $200,000 to resolve potential violations and undertake a corrective action plan that includes two years of monitoring. In the press release, OCR Director Roger Severino ominously stated, “This first resolution of the year signals that our Right of Access Initiative is still going strong and that providers of all sizes need to respect the right of patients to have timely access to their medical records.”
Health care providers routinely receive requests for medical records and other records. Reviewing and responding to those requests can be time consuming and administratively burdensome. However, putting in place policies and procedures, developing template forms for intake and response, and assigning responsibility and training regarding answering medical records requests are successful tools in minimizing the risk of an OCR enforcement action.
In short, Covered Entities should be ready for the Right of Access Initiative by reviewing their policies and practices to ensure that they timely respond to patient requests for access to medical records in compliance with HIPAA rules. Health care providers should also be aware of State (in this case Florida) law in this area, which may impose additional or more strict obligations that are not preempted by HIPAA. In the event that the State law grants greater rights to patients, for example, the State law requires a response to request for records in a shorter timeframe than HIPAA, then the State law must be followed.
The Healthcare Team at Lowe & Evander, P.A. understands the hard work and sacrifices it takes to become a health professional or provider and aggressively defends health professionals regarding protecting their license, practice, career, assets and reputation. Using our experience and expertise, we navigate the obstacles our clients face, serving not only as their attorneys, but also as their legal strategists, trusted advisors and protectors of their rights and interest against government investigations and lawsuits when necessary, and we help chart a course through the maze of state and federal health care laws, rules and regulations.
Look for our next installment in this series shortly!
Michael R. Lowe, Esquire is a Florida board-certified health law attorney at Lowe & Evander, P.A. Brian C. Evander , Esquire and Mr. Lowe regularly represent providers, physicians and other licensed health care professionals, and facilities in a wide variety of health care law matters.
For more information regarding those health care law and such matters please visit our website www.lowehealthlaw.com or call our office at (407) 332-6353.
The information provided in this article does not, and is not intended to, constitute legal advice; instead, all information and content in this article are intended to convey general informational only and may not constitute the most up-to-date legal or other information. Readers of this article should contact their attorney to obtain advice with respect to any particular legal matter. No reader of this article should act or refrain from acting on the basis of information in this article without first seeking legal advice from counsel in the relevant jurisdiction. Only your individual attorney can provide assurances that the information contained herein – and your interpretation of it – is applicable or appropriate to your particular situation.
