The Office for Civil Rights (OCR) at the US Department of Health and Human Services announces the resolution of its twentieth investigation in its HIPAA Right of Access Initiative. OCR created this initiative to support individuals’ right to timely access their health records at a reasonable cost under the HIPAA Privacy Rule. Children’s Hospital & Medical Center (CHMC) has agreed to take corrective actions and pay $80,000 to settle a potential violation of the HIPAA Privacy Rule’s right of access standard. CHMC is located in Omaha, Nebraska, and provides pediatric healthcare services. In May 2020, a parent filed a complaint with OCR alleging that CHMC had failed to provide her with timely access to her minor daughter’s medical records. CHMC provided some records but did not provide all of the requested records to the parent’s multiple follow-up requests. OCR initiated an investigation and determined that CHMC’s failure to provide timely access to the requested medical records was a potential violation of the HIPAA right of access standard, which requires a covered entity to take action on an access request within 30 days of receipt (or within 60 days if an extension is applicable). As a result of OCR’s investigation, the parent finally received all of the requested records.
