While federal healthcare enforcement policy has changed significantly since the Biden administration took over, the one initiative that has remained on steady course is the crackdown on providers that fail to provide patients timely access to their protected health information (PHI) under the HIPAA Privacy Rule. On July 15, the Department of Health & Human Services (HHS) Office for Civil Rights (OCR) announced 11 new enforcement actions, including the biggest penalty doled out since the agency began the right of access program back in April 2019—$240,000 against Texas nonprofit Memorial Hermann Health System.

The HIPAA Privacy Rule 30-Day Rule

The HIPAA Privacy Rule requires labs and other covered entities to respond to an individual’s request for access to their PHI within 30 calendar days. Providers can extend the deadline an additional 30 calendar days by sending the requestor a written statement explaining the reasons for the delay and the date by which the access request will be processed.

These timelines apply regardless of whether the requested PHI is maintained by the covered entity or a business associate acting on its behalf. In other words, labs don’t get extra time to sort things out with their business associates. Significantly, the 30-day clock begins to tick when the access request is received rather than the date any negotiations with the requestor end.

The OCR Right of Access Crackdown

Foot dragging has been a problem almost from the moment the 30-day right of access rule took effect. Previously, patients would complain to the OCR, which would then intervene and maybe issue a warning to the provider. Actual penalties, however, were fairly rare.

All that changed in April 2019, when the OCR announced a new enforcement initiative to impose penalties on access delays. “It should not take a federal investigation before a HIPAA covered entity provides patients, or their personal representatives, with access to their medical records,” noted current OCR director Lisa J. Pino in announcing the latest round of enforcement actions.

The OCR has now handed out 38 penalties, seven of them in the six-figure range, under the initiative. In addition to the monetary settlement, each accused provider was required to implement a corrective action plan and allow the OCR to conduct close monitoring for one to two years.

Here’s a scorecard of all announced settlements to date.

OCR Right of Access Initiative Settlements Scorecard (as of August 5, 2022)

*In addition to the monetary settlement, each accused provider had to agree to implement a corrective action plan and allow the OCR to conduct close monitoring for one to two years