HIPAA not only protects privacy, but also protects patients’ rights to obtain their own medical records.
Delay is Unacceptable under HIPAA
A mother tried to obtain her son’s medical records from the hospital. She asked for the records in January, 2018, and again in March, April and May, 2018. Dignity Health, doing business as St. Joseph’s Hospital and Medical Center (“SJHMC”) provided her with incomplete records, so she followed up with requests for the missing pieces at least three times during May. She filed a HIPAA complaint with the Office for Civil Rights (OCR) and they began an investigation.
She didn’t receive the full set of records until December, 2019, twenty two months after her first request. OCR found that SJHMC “failed to provide timely access to protected health information about an individual in a designated record set.” SJHMC has agreed to pay a settlement of $160,000, and enter a corrective action plan for one year, with continued monitoring by OCR.
Dignity Health is a California-based not-for-profit public-benefit corporation that operates hospitals and ancillary care facilities in three states. It’s the fifth-largest hospital system in the nation and the largest not-for-profit hospital provider in California. SJHMC, part of Dignity Health, is based in Phoenix, Arizona. It is a large, acute care hospital with several hospital-based clinics that provide a wide range of health, social, and support services.
Right of Access Initiative
Last year OCR announced the Right of Access Initiative as an enforcement priority to support individuals’ right to timely access to their health records at a reasonable cost under the HIPAA Privacy Rule. A patient’s right to obtain their own records (or a parent to obtain a minor child’s) is fundamental to quality health care and central to HIPAA.
A patient’s right of access to medical records has been an OCR priority for years, but the Right of Access Initiative began in order to correct widespread noncompliance. This is the eighth enforcement action in the Right of Access Initiative. Five OCR settlements in Right of Access investigations were just announced last month. On October 9, 2020 OCR announced its ninth settlement under the HIPAA Right of Access Initiative. NY Spine paid $100,000 and agreed to a two-year corrective action plan.
Compliance is Cost Effective and Saves Time
Knowing the HIPAA rules, being proactive, and doing the right thing the first time is much less costly than noncompliance. If you don’t understand how to comply with patients’ requests for their records, ask us at The HIPAA E-Tool®.
Photo by Anna Shvets from Pexels