Riverside Psychiatric Medical Group (“RPMG”) has agreed to take corrective actions and pay $25,000 to settle a potential violation of the HIPAA Privacy Rule’s right of access standard. RPMG, based in Riverside, California, is a group practice specializing in child and adolescent psychiatry, geriatric psychiatry, neuropsychiatry, psychology, and substance use disorders. In March 2019, OCR received a complaint from a patient alleging that RPMG failed to provide her a copy of her medical records despite multiple requests to RPMG beginning in February 2019. Shortly after receiving the complaint, OCR provided RPMG with technical assistance on how to comply with the HIPAA Right of Access requirements and closed the matter. In April 2019, however, OCR received a second complaint alleging that RPMG still had not provided the complainant with access to her medical records.
OCR initiated an investigation and determined that RPMG’s failure to take action in response to the individual’s request was a potential violation of the HIPAA right of access standard. RPMG claimed that because the requested records included psychotherapy notes, they did not have to comply with the access request. While the HIPAA Rules do not require production of psychotherapy notes, they do require covered entities (1) to provide requestors a written explanation when it denies any records request in whole or in part (which RPMG did not do), and (2) to provide the individual access to his or her medical records other than psychotherapy notes (and information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding).
As a result of OCR’s investigation, RPMG sent the individual all the requested information in her medical record, excluding psychotherapy notes, in October 2020. “When patients request copies of their health records, they must be given a timely response, not a run-around,” said OCR Director Roger Severino. In addition to the monetary settlement, RPMG will undertake a corrective action plan that includes two years of monitoring. The resolution agreement and corrective action plan may be found at: https://www.hhs.gov/sites/default/files/riverside-ra-cap.pdf – PDF.
