By Beth Anne Jackson and Allison Shelton, Brown & Fortunato, P.C.
Since the Office for Civil Rights (OCR) announced its first enforcement action under the Right of Access Initiative in September 2019, nine providers have settled allegations that they failed to provide patients with copies of their medical records in a timely manner. Seven of those settlements have been announced since September 2020, indicating that the COVID pandemic will not stop OCR’s enforcement efforts. It should be noted, however, that all the alleged conduct occurred pre-COVID.
Generally, under the HIPAA right of access provisions, providers who are covered entities have 30 days to respond to requests for medical records by patients or their personal representatives. One extension of 30 days may be made if the provider timely notifies the patient of the reason for the delay and when the records will be available. Patient complaints and OCR audits revealed concerning rates of failure to abide by this rule, leading to OCR’s Right of Access Initiative.
OCR Director Roger Severino said of the Initiative: “For too long, healthcare providers have slow-walked their duty to provide patients their medical records out of sleepy bureaucratic inertia. We hope our shift to the imposition of corrective actions and settlements under our Right of Access Initiative will finally wake up healthcare providers to their obligations under the law.”
OCR has lived up to that promise. Monetary settlements to date have ranged from a low of $3,800 to a high of $160,000. Both the size of the provider and the egregiousness of the provider’s conduct seems to play a role in the amount of the settlement. In the highest dollar-value settlement, announced on October 7, 2020, Dignity Health agreed to pay $160,000 to settle allegations that it failed to provide all medical records requested for a period of 22 months. The complaint was filed 3 months after the complainant’s initial request and two additional requests. The complainant made three additional contacts with the provider to secure the records without success soon after filing the complaint. The lowest settlement was with a small psychiatric practice, King, M.D. This provider failed to provide medical records not only after a complaint but also after OCR provided technical assistance regarding the practice’s obligations to do so. The conduct involved in other settlements involved not providing records in connection with various requests, including requests: by a daughter for her father’s behavioral health records; by a mother for records regarding her unborn son; by a father for his minor son’s psychiatric records; for diagnostic films including x-rays, CTs and MRIs; for inspection of records; and for electronic disclosure to a third party designated by the patient.
All providers that entered into settlement agreements with OCR were required to abide by a corrective action plan (CAP) that involved one or two years of monitoring and reporting. For settling providers, the cost of complying with the CAP may exceed their monetary settlement payments. The CAPs are substantially similar and require the intimate involvement of OCR in the providers’ release of information (ROI) programs, whether the relevant processes are carried out by the providers themselves or by business associates of the provider. Significant attention and resources are necessary to monitor and ensure compliance with the CAP and to report any violations of patients’ right to access. Specifically, the CAPs require the providers to: submit right of access policies and procedures to OCR for review and approval; make and implement any recommended changes to such policies; obtain signed certifications from workforce members and business associates to the effect that they have read, understand and will abide by the policies and procedures; review policies and procedures as needed, and at least annually; submit any policy changes to OCR; disclose to OCR the names of all business associates that are involved in the providers’ ROI processes; submit training materials and documentation to OCR; submit annual reports to OCR, and submit an implementation report to OCR within 120 days of the settlement effective date. Failure to abide by the CAP can result in OCR taking further action on the original complaint.
Patients’ right to access their medical records has existed nationally since 2003 when the original HIPAA privacy rules took effect. These rights were enhanced with rules implementing the HITECH Act in September of 2013. The COVID pandemic has placed the nation’s health care system under extreme stress. While there has been no announcement of enforcement actions for conduct occurring during the pandemic, providers should not be tempted to let patients’ right to access their own medical records become a lower priority as challenges in providing care mount. Because of such challenges, perhaps now more than ever, patients’ access to their medical information is essential to ensuring that their health needs – whether related to COVID or not – are addressed.