The U.S. Department of Health and Human Services' Office of Civil Rights announced this week that five providers had agreed to pay settlements for potential violations of the HIPAA Privacy Rule's right of access provision.

Beth Israel Lahey Health Behavioral Services' settlement was the largest of the group, with the Massachusetts-based network of mental health and substance use disorder services agreeing to pay OCR $70,000 and to adopt a corrective action plan. 

The other settlements ranged from $3,500 to $38,000. They come as part of the OCR's ramped-up intention to "vigorously enforce" the rights of patients to access their records in a timely fashion without being overcharged.

The announcement, said OCR Director Roger Severino in a statement, "is about empowering patients and holding health care providers accountable for failing to take their HIPAA obligations seriously enough."

WHY IT MATTERS

In 2019, OCR announced the Right of Access Initiative as an enforcement priority. Since then, it has completed seven enforcement actions, including the five this week.

According to the agency, OCR received a complaint in April 2019 alleging that Beth Israel Lahey Health Behavioral Services had failed to respond to a request two months prior from an individual seeking her father's medical records.

After an investigation, OCR found that the failure to provide such records represented a potential violation of the HIPAA right of access standard. As a result, Beth Israel sent the individual the medical records in October 2019, in addition to agreeing to pay the $70,000 and to adopt a corrective action plan.

Housing Works, Inc., a New York City-based nonprofit providing a variety of services, including healthcare, allegedly failed to provide a complainant with a copy of his medical records in June 2019. OCR provided Housing Works with technical assistance and then closed the complaint. But in August 2019, the individual said Housing Works still hadn't given him access to his records. After an investigation, Housing Works agreed to pay OCR $38,000 and to adopt a corrective action plan.

Similar complaints led to settlement agreements of $15,000 at All Inclusive Medical Services, a California-based family medicine clinic; $10,000 at Wise Psychiatry, PC, a psychiatric service provider in Colorado; and $3,500 at King MD, a small healthcare provider of psychiatric care in Virginia.

OCR considers a variety of factors when determining settlement amounts, said the agency, including the nature and extent of the potential violation, the nature and extent of the harm from said potential violation, and the financial condition of the agency, such as its size and the impact it has experienced from COVID-19.

THE LARGER TREND

Apart from the potential fines levied as a result of failing to release medical records, providers have also faced actions from individuals.

Earlier this month, a widow in upstate New York sued an area hospital network and Ciox Health, alleging that their failure to release her late husband's medical records to her electronically was preventing her from filing a medical malpractice suit after his death.

"The maximum charge for electronic medical records under federal law is $6.50," the widow's lawyer, John Fisher, told Healthcare IT News. "But if they charge for the paper copy of the records, it could be thousands of dollars."

The November deadline for providers to be in compliance with the Office of the National Coordinator for Health IT's info-blocking rules is also looming, with hefty penalties a possibility for those who interfere with the access, exchange or use of electronic health record information.

ON THE RECORD

"Patients can't take charge of their health care decisions, without timely access to their own medical information," said Severino in the statement accompanying the settlement announcement.

Kat Jercich is senior editor of Healthcare IT News.
Twitter: @kjercich
Email: kjercich@himss.org
Healthcare IT News is a HIMSS Media publication.