The Office of Civil (OCR) rights announced on September 4 that it has assessed its first financial penalty for delayed provision of patient access to medical records. Hospital and medical offices have frequently been the object of HIPAA complaints for not allowing patients access to their records, delaying responses for records requests, and over-charging patients for records. These requests are often viewed by hospitals and medical offices as bothersome and time-consuming, but many malpractice insurance companies view these requests as indicators of potential litigation. Now, they have progressed to a potential source of OCR compliance enforcement and fines.
The OCR announcement states:
Today, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services is announcing its first enforcement action and settlement in its Right of Access Initiative. Earlier this year, OCR announced this initiative promising to vigorously enforce the rights of patients to receive copies of their medical records promptly and without being overcharged.
Bayfront Health St. Petersburg (Bayfront) has paid $85,000 to OCR and has adopted a corrective action plan to settle a potential violation of the right of access provision of the Health Insurance Portability and Accountability Act (HIPAA) Rules after Bayfront failed to provide a mother timely access to records about her unborn child. Bayfront, based in St. Petersburg, Florida, is a Level II trauma and tertiary care center licensed as a 480-bed hospital with over 550 affiliated physicians.
OCR initiated its investigation based on a complaint from the mother. As a result, Bayfront directly provided the individual with the requested health information more than nine months after the initial request. The HIPAA Rules generally require covered health care providers to provide medical records within 30 days of the request and providers can only charge a reasonable cost-based fee. This right to patient records extends to parents who seek medical information about their minor children, and in this case, a mother who sought prenatal health records about her child.
In addition to the monetary settlement, Bayfront will undertake a corrective action plan that includes one year of monitoring by OCR. The resolution agreement and corrective action plan may be found at: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/bayfront/index.html
I have experienced long delays in obtaining my own medical records or test results. I believe a limit of 5 days is more than adequate for laboratory study results, and 10 days for medical records. The fine was too low to send a message to all healthcare institutions and healthcare offices. There has to be a ceiling limit as well on the “reasonable charge.” The final results and records belong to the patient, since the service was paid for by the patient’s insurance company, which in turn was usually paid for by the patient/consumer in question.