The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) recently settled its ninth enforcement action under HIPAA’s right of access provisions.  This settlement demonstrates OCR’s continued focus on ensuring covered entities provide patients timely access to their medical records at a reasonable cost.

In this case, the patient requested access to her protected health information (PHI) several times from NY Spine Medicine (NYSM) beginning on June 10, 2019, including a written request via certified mail on June 26, 2019.  On July 22, 2019, the patient filed a complaint with OCR. Between the months of October 2019 and March 2020, OCR sent numerous correspondence to NYSM regarding the complaint, with deadlines for response, but NYSM failed to appropriately respond.  As of the date of the HIPAA settlement (September 29, 2020), the patient had not been provided access to the MRI, X-ray and CT images she specifically requested.  OCR concluded NYSM failed to provide the patient access to her PHI as required under 45 C.F.R. § 164.524.  As a result, NYSM agreed to pay $100,000 to settle the matter.

OCR’s recent string of enforcement activity under HIPAA’s right of access serves as a reminder of several key points:

• Covered entities must provide patients access to their PHI within 30 days of request.
• Unless an exception applies, covered entities must provide all records requested, not just some of the records.
• The records to be produced include all requested records in the provider’s designated record set, even if the records came from a third party and were not created by the covered entity. 
• The covered entities should produce the records in the form and format requested, if readily producible in that form and format. 
• Covered entities may only charge a reasonable, cost-based fee if the patient requests a copy of their PHI.  The fee may only include supplies, postage, and the actual cost of labor to produce the records.  The fee may not include other costs, even if those costs may be authorized under State law.

For more information on the HIPAA right of access, see the HHS guidance on Individual’s Right under HIPAA to Access their Health Information.

Written By: Jacob Simpson