The Office for Civil Rights, which enforces HIPAA, announced its 49th patient right of access settlement on August 1, 2024. American Medical Response (AMR), a provider of emergency medical services across the United States, is paying $115,200 in civil money penalties to settle the investigation.

It all started after OCR received a complaint in July 2019, alleging that AMR failed to provide a patient with timely access to their medical records after the patient had tried and failed many times.

OCR initiated an investigation and found that AMR failed to provide the patient timely access to her medical records. HIPAA’s right of access provisions require covered entities to act on requests for records access within 30 days of receiving the request. 

Civil Money Penalties are Imposed

In response to OCR’s investigation, AMR sent the patient a copy of her requested records and amended its internal procedures to streamline and better track right of access requests to follow the law. The affected patient received her records in November 2019, 370 days after her initial request.

In October 2023, OCR issued a Notice of Proposed Determination seeking to impose a civil money penalty. AMR waived its right to a hearing and did not contest OCR’s findings. OCR finalized its determination and imposed the civil money penalty against AMR this year. 

Melanie Fontes Rainer, OCR director, said:

“HIPAA gives patients a right to timely access to their medical records. OCR will continue to enforce this right through investigations and, when necessary, by imposing civil money penalties.”

Patient Right of Access is Easy to Follow

• The patient may choose the form and format of the records—paper or electronic and delivered by mail or email.
• Produce the records promptly, but take no longer than 30 days unless there is a good reason for more time. If so, notify the patient that another 30 days will be needed. NOTE: If state law is stricter than HIPAA, follow the State. California, for example, requires copies to be provided within 15 days, or access to view them during business hours within five days
• Fees, if any, should be minimal. NOTE: Due to a 2019 court decision, a higher fee may be charged when a patient requests records be sent to a third party. (Ciox Health vs. Alex Azar)
• Don’t confuse the right of access (for the individual) with a required HIPAA authorization (for a third party)