OCR settles cases in HIPAA right of access initiative

The Office for Civil Rights (OCR) announced on September 16 that it settled five investigations in its HIPAA Right of Access initiative.

The initiative was initially unveiled in 2019 as an enforcement priority to support individuals’ right to timely access of their health records at a reasonable cost under the HIPAA Privacy Rule. Overall, OCR has completed seven total enforcement actions under the HIPAA Right of Access initiative.

The following five settlements were recently announced by OCR:

• All Inclusive Medical Services, Inc. (AIMS), based in Carmichael, California, agreed to pay OCR $15,000 and adopt a corrective action plan to settle a potential violation of the HIPAA Privacy Rule. In January 2018, a patient alleged that AIMS refused to give her access to her medical records. After an OCR investigation determined that AIMS’ actions qualified as potential HIPAA violations, AIMS sent the patient her medical records in August 2020.
• Beth Israel Lahey Health Behavioral Services (BILHBS), which provides mental health and substance use disorder services in Massachusetts, agreed to pay $70,000 to OCR and to adopt a corrective action plan to settle a potential HIPAA violation. The potential violation stems from a February 2019 incident when BILHBS failed to provide the requested medical records to a patient’s personal representative.
• Housing Works Inc., a New York City-based non-profit organization that provides healthcare for individuals affected by HIV/AIDs, agreed to pay $38,000 to OCR and to adopt a corrective action plan to settle a potential HIPAA violation. The potential violation stems from two complaints alleging that Housing Works failed to provide an individual with a copy of his medical records. Following the initial complaint in July 2019, OCR provided Housing Work with technical assistance to help it solve the issue. However, in August 2019, OCR received a second complaint from the patient that Housing Works still had not provided the requested records.
• Patricia King MD & Associates (King MD), a psychiatry specialist based out of Chesapeake, Virginia, agreed to pay $3,500 to OCR and to adopt a corrective action plan to settle a potential HIPAA violation. OCR received a patient complaint in October 2018 regarding King MD’s failure to provide requested medical record. OCR offered technical assistance, but in February 2019 it received a follow-up complaint that King MD still had not provided the patient with her requested medical records. Following OCR’s investigation, King MD sent the patient her records in July 2020.
• Wise Psychiatry, based out of Centennial, Colorado, agreed to pay $10,000 to OCR and to adopt a corrective action plan to settle a potential HIPAA violation. The potential violation stems from a February 2018 complaint that Wise Psychiatry failed to provide a personal representative with access to the medical records of his son, who was a minor. After OCR provided technical assistance to Wise Psychiatry, OCR received a second complaint from the patient’s personal representative in October 2018. Following an OCR investigation, the medical records were provided in May 2019.

For additional information on the HIPAA Right of Access initiative, visit the U.S. Department of Health and Human Services  website.