On September 9, 2019 the Office of Civil Rights (OCR) of the U.S. Department of Health and Human Services announced its first enforcement action and settlement of its Right of Access Initiative. This follows an OCR announcement earlier this year of its intention to vigorously enforce patients' rights to promptly receive copies of their medical records, without being overcharged.

A 480 bed Florida hospital paid OCR $85,000 and adopted a corrective action plan in settlement of the claimed violation of HIPAA's right of access because the hospital failed to provide a mother timely access to records about her unborn child. OCR's investigation was launched following the mother's complaint, resulting in the hospital directly providing the requested medical records more than nine months following the initial request. HIPAA's right of access rule generally requires covered health providers to provide medical records within 30 days after request, and prohibits charging more than a reasonable cost-based fee. The rule applies to parents seeking information about their minor children, including patient records of the mother's unborn child.

While the amount involved in this action is relatively small, hospitals, physicians and other covered entities should take note that OCR has made clear its intentions to vigorously enforce the HIPAA right of access rule. Covered entities should review their policies and procedures to ensure compliance.