The Right of Access Rule gives patients and their representatives the right to access, inspect and obtain a copy of their own health information. When a provider receives a request for access to their medical records, they must provide the requested information within 30 days (Some states require a faster response 30 days is the HIPAA requirement).
Historically health care providers have often failed to respond in a timely manner and as a result in 2019 the Office for Civil Rights (OCR) announced it would be cracking down on medical providers who violated the Right of Access Rule. This is referred to as the “HIPAA Right of Access Initiative”.
In the case of Banner Health, OCR received two complaints from patients citing long delays in receiving copies of medical records. According to reports it took 5 months for Banner Health to respond to these requests. The $200,00 is the largest payment to date for violation of the Right of Access Rule.
On October 6, OCR published a press release titled “OCR Settles Tenth Investigation in HIPAA Right of Access Initiative” In this case the fine was $25,000 for Riverside Medical Group. A patient filed multiple requests in February of 2019. A complaint as filed in March of 2019 and the OCR responded by providing Riverside Medical Group with Technical Assistance on how to comply with the HIPAA Right of Access Rule. In April of 2019 a second complaint and the patient finally received their records in October of 2020.
November 12 OCR Settles Eleventh Investigation in HIPAA Right of Access Initiative This settlement was with a doctor in private practice who agreed to pay $15,000 to settle the case. This was a single patient who filed a compliant. The patient initially requested her records in July of 2018 and finally received the records in September of 2020.
November 19 OCR Settles Twelfth Investigation in HIPAA Right of Access Initiative. This settlement was with the University of Cincinnati Medical Center for $65,000. This case involved a single patient. The patient requested their records in February of 2019. An initial complaint was filed in May of 2019. The patient finally received their records in August of 2019
December 22 saw a settlement with an individual doctor Peter Wrobel, MD PC for $36,000 This case involved a single patient. The patient filed their initial complaint in April of 2019. OCR then provided technical assistance to the doctor in May of 2019 so that they understood their responsibility and could respond to the patients request. In October of 2019 the patient filed a second complaint and finally received their records in May of 2020.
If you read into each of these cases, there seems to be some common threads. Where a single patient was involved, an initial complaint was filed. It appears that the provider did not respond to the first complaint and that resulted in the second complaint being filed. An important part of this process is that OCR appears to reach out to organizatoins after an initial complaint to help the organization comply with the Right of Access Rule Upon filing the second complaint OCR launched an investigation which resulted in a fine. When multiple patients were involved two complaints from two separate patients resulted in the investigation. Reading the press release it seems that if OCR receives two complaints either from one or two patients, they will launch an investigation which can result in a fine.
Organizations as large as Banner Health and as small as a single private practitioner have been fined for violations of the Right of Access Rule. What steps can you take in your practice to minimize the chance of patients filing complaints which ultimately reduces the possibility of you being investigated by OCR and fined by OCR?
- When you receive a request for medical records – log that request in some form of a logbook. That log should include a time and date stamp.
- If the request came in an envelope – keep the envelope with the postmark
- Notify the patient that you have received the request and will process the request within the 30 days as required by the Right of Access Rule
- Process the request and send the records to the patient. Send the records via a method that can be tracked. Keep a copy of the proof of sending the document(s) along with proof of delivery.
These documents can demonstrate when the request was received and that you responded to the requests in a timely manner. From a medical legal standpoint, it is always a good idea to notify your malpractice carrier that you received a request for a copy of the medical records. In fact, your policy may have a requirement that you notify the carrier and failure to do so may jeopardize some of your rights under your insurance policy – check with your carrier for their rules and policies.
Read Comments