In the first settlement under the Biden Administration, on February 10th the Office for Civil Rights (“OCR”) at the U.S. Department of Health and Human Services (“HHS”) announced a settlement of a fifteenth enforcement action under its HIPAA Right of Access Initiative (the “Initiative”). The Initiative is an OCR enforcement priority to support individuals’ right to timely access their health records at a reasonable cost under the Health Insurance Portability and Accountability Act (“HIPAA”) Privacy Rule. Earlier this year, a large health system agreed to pay $200,000 under the Initiative.
In this most recent settlement, Renown Health, P.C. (“Renown”), a private, not-for-profit health system in Nevada, agreed to pay $75,000 and enter into a corrective action plan (“CAP”) to resolve a potential violation of the HIPAA Privacy Rule’s right of access standard. In February 2019, OCR received a complaint alleging Renown failed to timely respond to a patient’s request that all protected health information in the patient’s electronic health record, including billing records, be sent to the patient’s attorney. Renown failed to provide access to all of the requested documents until December 2019. OCR investigated and determined Renown’s failure to provide timely access to the requested records was a potential violation of the HIPAA right of access standard.
In addition to the monetary settlement, Renown entered into a CAP that did not include an admission of liability. Under the CAP, Renown will be subject to two (2) years of HHS monitoring and must do each of the following:
- Develop, maintain, and revise its written HIPAA right of access policies and procedures, which must be submitted to HHS for review and approval;
- Distribute HHS-approved policies and procedures to members of Renown’s workforce and provide proof of such distribution to HHS;
- Ensure revised policies and procedures include minimum content requirements set forth in the CAP;
- Submit for HHS review revised workforce training materials and, upon receiving HHS’ approval, train Renown’s workforce members using the revised training materials;
- Revise Renown’s Notice of Privacy Practices to accurately reflect and convey to the public the steps individuals must take when requesting access to protected health information; and
- Report to HHS any workforce member who materially fails to comply with the revised policies and procedures described above.
This settlement should be a reminder to all HIPAA-covered entities that compliance with the HIPAA right of access remains critical and may continue to be an enforcement priority of the Biden Administration. Covered entities should review their HIPAA policies and procedures to ensure they are providing individuals with prompt and complete medical records at a reasonable cost when requested, and that their Notice of Privacy Practices accurately reflects the steps individuals need to take to make such requests.
