The U.S. Department of Health and Human Services Office of Civil Rights announced this week that it had brought HIPAA-related enforcement actions against five healthcare providers.  

The actions brought the total number of enforcements carried out under the agency's HIPAA Right of Access Initiative to 25.  

"Timely access to your health records is a powerful tool in staying healthy, patient privacy and it is your right under law," said OCR Director Lisa J. Pino in a statement.

WHY IT MATTERS  

As the press release notes, the Right of Access Initiative is intended to support individuals' ability to get their health records in a timely fashion at a reasonable cost, as HIPAA requires.  

Without an extension, a HIPAA-regulated entity must provide an individual or a representative with their records 30 days after receiving a request.  

In one of the most recent enforcement actions, the Ohio-based Advanced Spine and Pain Management was accused of waiting nearly four months to send a patient a copy of their protected health information. The provider was fined $32,150.  

In another action, the Rainrock Treatment Center, located in Eugene, Oregon, paid OCR $160,000 after a patient said it had sent their records on May 22, 2020 – almost eight months following the initial request.  

In a third, Dr. Robert Glaser was fined $100,000 after failing to provide a patient with his medical records after several years. Glaser, a solo practitioner in New York State, also did not cooperate with the agency's investigation or respond to OCR's data requests. Glaser also waived the right to a hearing.  

The fourth and fifth enforcement actions also involved delays in releasing medical records to patients. Denver Retina Center paid $32,150 to settle a potential HIPAA violation, and Wake Health Medical Group paid $10,000.  

THE LARGER TREND  

OCR has been carrying out right of access enforcement actions since 2019, when it fined a Florida hospital $85,000 for failing to give a pregnant person access to their medical records.  

Although the presidential administration – and head of OCR – has changed, the agency shows no signs of slowing: In 2021, it's pursued roughly a dozen cases.  

Still, patients are sometimes driven to bring their own legal actions. In September 2020, a widow living in upstate New York sued a hospital there for allegedly declining to release her deceased husband's electronic health records in a non-paper format.

ON THE RECORD  

"OCR will continue its enforcement actions by holding covered entities responsible for their HIPAA compliance and pursue civil money penalties for violations that are not addressed," said Pino.  

Kat Jercich is senior editor of Healthcare IT News.
Twitter: @kjercich
Email: kjercich@himss.org
Healthcare IT News is a HIMSS Media publication.