The Office for Civil Rights (OCR) at the US Department of Health and Human Services (HHS) announces its twelfth settlement of an enforcement action in its HIPAA Right of Access Initiative. The University of Cincinnati Medical Center, LLC (UCMC), which is an academic medical center providing healthcare services to the Greater Cincinnati community, has agreed to take corrective actions and pay $65,000 to settle a potential violation of the HIPAA Privacy Rule’s right of access standard. In May 2019, OCR received a complaint alleging that UCMC failed to respond to a patient’s February 22, 2019, records access request directing UCMC to send an electronic copy of her medical records maintained in UCMC’s electronic health record (EHR) to her lawyers. OCR initiated an investigation and determined that UCMC failed to timely provide a copy of the requested medical records in potential violation of the HIPAA Rules, which include the right of patients to have electronic copies of records in an EHR transmitted directly to a third party. As a result of OCR’s investigation and intervention, the complainant received all of the requested medical records in August 2019. In addition to the monetary settlement, UCMC will undertake a corrective action plan that includes two years of monitoring. A copy of the resolution agreement and corrective action plan may be found at https://www.hhs.gov/sites/default/files/university-of-cincinnati-medical-center-ra-cap.pdf – PDF.
