Today, the US Department of Health and Human Services (HHS), Office for Civil Rights (OCR), announced a settlement with Phoenix Healthcare, an Oklahoma multi-facility organization in nursing care. The settlement resolves a potential violation under the Health Insurance Portability and Accountability Act (HIPAA) Right of Access provision, requires that individuals or their personal representatives have timely access to their health information. Under HIPAA, it is required that a covered entity must provide access to the protected health information within 30 days of receiving an individual’s request. OCR’s investigation involved a daughter, serving as a personal representative for her mother, who was not able to obtain access to her mother’s protected health information for nearly one year, despite multiple requests. The agreement marks OCR’s 47th Right of Access enforcement action. In April 2019, a complaint was filed with OCR alleging that Phoenix Healthcare would not provide a daughter, who serves as a personal representative, with a copy of her mother’s medical records. After attempt at technical assistance and attempts to get the records by OCR, Phoenix Healthcare sent the requested records on January 30, 2020, 323 days after the request.
