Today, the US Department of Health and Human Services (HHS), Office for Civil Rights (OCR), announced a $100,000 civil monetary penalty against Essex Residential Care, LLC, doing business as Hackensack Meridian Health, West Caldwell Care Center (“Hackensack Meridian Health”), a skilled nursing facility that provides long-term care and rehabilitation services. OCR investigated Hackensack Meridian Health under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule for failing to provide a patient’s personal representative with timely access to the patient’s medical records. In May 2020, OCR received a complaint alleging that Hackensack Meridian Health failed to provide a personal representative with access to his mother’s medical records. The records were allegedly withheld even after Hackensack Meridian Health received sufficient documentation demonstrating that the son was serving as his mother’s personal representative. The requested records were sent to the personal representative in November 2020, as a result of OCR’s investigation. OCR found that Hackensack Meridian Health failed to respond timely to a HIPAA right of access request. In September 2023, OCR issued a Notice of Proposed Determination seeking to impose a civil money penalty. Hackensack Meridian Health waived its right to a hearing and did not contest OCR’s findings. Accordingly, OCR imposed a civil money penalty of $100,000.
