The Office for Civil Rights (OCR) at the US Department of Health and Human Services (HHS) announces that it has settled its eighth enforcement action in its HIPAA Right of Access Initiative. OCR announced this initiative as an enforcement priority in 2019 to support individuals’ right to timely access to their health records at a reasonable cost under the HIPAA Privacy Rule. Dignity Health, doing business as St. Joseph’s Hospital and Medical Center (“SJHMC”), has agreed to take corrective actions and pay $160,000 to settle a potential violation of the HIPAA Privacy Rule’s right of access provision. SJHMC, based in Phoenix, Arizona, is a large, acute care hospital with several hospital-based clinics that provide a wide range of health, social, and support services.
On April 25, 2018, OCR received a complaint from a mother alleging that beginning in January 2018, she made multiple requests to SJHMC for a copy of her son’s medical records, as his personal representative. SJHMC provided some of the requested records, but despite the mother’s follow up requests in March, April, and May 2018, SJHMC did not provide all of the requested records. OCR initiated an investigation and determined that SJHMC’s actions were a potential violation of the HIPAA right of access standard. As a result of OCR’s investigation, SJHMC sent all of the requested medical records to the mother on December 19, 2019, more than 22 months after her initial request.
The resolution agreement and corrective action plan can be read here.
