OCR enforces first case under HIPAA right of access push

The Office for Civil Rights (OCR) reached a settlement with Bayfront Health St. Petersburg, a Florida hospital, for allegedly violating the HIPAA Privacy Rule’s right of access provision when it failed to give a mother timely access to her unborn child’s records, according to an OCR press release. The settlement marked OCR’s first enforcement action under its right of access initiative, announced earlier this year.

The mother requested her child’s fetal-monitoring records from Bayfront in October 2017, but Bayfront said those records were unavailable, an OCR investigation found. After the mother’s counsel requested the records twice in early 2018, Bayfront provided them in August of that year.

“Bayfront directly provided the individual with the requested health information more than nine months after the initial request,” OCR said in the press release.

That’s a potential HIPAA violation, according to OCR. In most cases, HIPAA requires covered entities to provide medical records within 30 days of the request. Additionally, parents have the right to obtain the medical records of their minor children.

“Providing patients with their health information not only lowers costs and leads to better health outcomes, it’s the law,” OCR Director Roger Severino said in the press release. “We aim to hold the health care industry accountable for ignoring peoples’ rights to access their medical records and those of their kids.”

Under the terms of the settlement, Bayfront agreed to pay OCR $85,000 and to adopt a corrective action plan, which includes one year of OCR monitoring.

Research suggests that covered entities commonly violate the HIPAA right of access provision. A recent study by Ciitizen found that more than half of healthcare providers are failing to comply with the rule.