Despite the tremendous stress being placed on our health care providers across the globe, it is important for them to remain attentive to their most basic obligations under HIPAA, including a patient’s right to access their medical records.
The Office of Civil Rights (OCR) of the Department of Health and Human Services has, with recent enforcement activities, provided harsh reminders of such duties to several non-compliant providers. The OCR has been particularly aggressive in investigating and settling official complaints filed by patients asserting that they requested but did not receive their medical records from a provider in a timely fashion – generally within 30 days of request.
On November 12, the office settled its 11th such investigation, with a New York private practitioner being forced to pay $15,000 for potential HIPAA violations after a patient made two separate complaints regarding the physician’s failure to provide her with a copy of her records. This latest case is a good indicator that the office is not just going after big health care systems in this initiative. Smaller practices hoping they could fly under the radar of the HIPAA requirements should not be surprised if the federal government knocks on their door in the next few months if they are not compliant.
The latest settlement is part of the HIPAA Right of Access Initiative from HHS. The initiative started in 2019 to ensure patients have access to their own medical records. Since mid-September, the OCR has settled nine investigations addressing complaints regarding access to medical records.
Patients are increasingly aware of their right to access their records, and the many ways this can be accomplished either directly or through a representative. This awareness has led to an increase in the number of formal HIPAA complaints made by patients when they feel stymied in their efforts to obtain their records. The fact that federal health officials have made access complaints a priority is a stark reminder to health care providers and their privacy officers that facilitating patient access needs to be a priority for them as well.
While the COVID-19 pandemic has stretched health care resources thin, the message from the OCR seems loud and clear: Pandemic or no, providers must timely respond to patient requests for their medical records.
If you have any questions on the legal implications of responding to patient requests for medical records or anything else HIPAA related, please contact Katherine Betz Kravitz, Peter Faben or any member of the Barley Snyder Health Care Industry Group.
