New Administration Continues OCR HIPAA Right of Access Initiative

Although the Biden administration has signaled its intention to revisit just about every healthcare regulatory initiative of its predecessor, one enforcement undertaking seems to be continuing seamlessly with no interruption: The HHS Office for Civil Rights (OCR) campaign to ensure providers recognize patients’ HIPAA access rights. The HIPAA Right of Access Initiative Historically, OCR enforcement of the HIPAA Privacy Rule has focused on unlawful collection, use and disclosure and provider efforts to keep personal health information (PHI) private and secure. But in April 2019, the agency announced that it was broadening its scope to include the part of the HIPAA Privacy Rule that requires labs and other providers to provide persons timely access to their PHI at a reasonable cost. Less than six months later, the OCR handed down its first ever fine to a provider for failing to comply with its right of access obligations. By the time the Trump administration left town, the agency had dished out no fewer than 14 such penalties, the final one at a record-high of $200,000. And, as expected, there would be more to come. Fines number 15 and 16 were announced in early February. To be fair, the latest fines represent the completion of cases started under the old administration; however, unlike some Trump enforcement activities, the HIPAA Right of Access Initiative is a bipartisan, fairly noncontroversial effort that is highly likely to continue without interruption under the new regime. Here’s a Scorecard of all announced settlements to date. OCR Right of Access Initiative Settlements Scorecard (as of Feb. 19, 2021)

Provider	Settlement Amount*	Allegations
Banner Health ACE	$200,000	OCR cites two occasions in which Phoenix-based not-for-profit health system took about 6 months to provide patients their requested PHI
St. Joseph’s Hospital and Medical Center	$160,000	Phoenix hospital refused to provide PHI to patient’s mother even though she was his legal representative
NY Spine Medicine	$100,000	Neurology practice refuses patient’s multiple requests for copies of specific diagnostic films
Bayfront Hospital	$85,000	Florida hospital didn’t provide expectant mother timely access to the PHI of her unborn child
Korunda Medical	$85,000	After first refusing to provide it at all, Florida primary care and interventional pain management services provider sent patient’s PHI to third party in the wrong format and charged him excessive fees
Renown Health, P.C.	$75,000	Nevada private, not-for-profit health system didn’t timely honor patient’s request to transfer her EHR and billing records to a third party
Sharp Rees-Stealy Medical Centers	$70,000	California hospital and healthcare network didn’t timely honor request to transfer patient’s EHR to a third party
Beth Israel Lahey Health Behavioral Services	$70,000	Massachusetts provider ignored request of personal representative seeking access to her father’s PHI
University of Cincinnati Medical Center, LLC	$65,000	Ohio academic medical center failed to respond to patient’s request to send an electronic copy of her medical records maintained in its electronic health record EHR to her lawyers
Housing Works Inc.	$38,000	New York City non-profit services provider refused patient’s request for a copy of his medical records
Peter Wrobel, M.D., P.C., dba Elite Primary Care	$36,000	Georgia primary care practice failed to provide patient access to his medical records
Riverside Psychiatric Medical Group	$25,000	California medical group didn’t provide patient copy of her medical records despite repeated requests and OCR intervention
Dr. Rajendra Bhayani	$15,000	NY physician didn’t provide patient her medical records even after OCR intervened and closed the complaint
All Inclusive Medical Services, Inc.	$15,000	California multi-specialty family medicine clinic refused patient’s requests to inspect and receive a copy of her records
Wise Psychiatry, PC	$10,000	Colorado psychiatric firm refused to provide personal representative access to his minor son’s medical record
King MD	$3,500	Virginia psychiatric practice didn’t provide patient access to her medical records even after OCR intervened, provided technical assistance and closed the complaint

*In addition to the monetary settlement, each accused provider had to agree to implement a corrective action plan and allow the OCR to conduct close monitoring for one to two years