Today, the US Department of Health and Human Services (HHS), Office for Civil Rights (OCR), announced a $200,000 civil monetary penalty against Oregon Health & Science University (OHSU), a public academic health center and research university, for violating an individual’s right to timely access her medical records through a personal representative. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule’s “Right of Access” provisions require that individuals or their personal representatives have timely access to health information requested from a HIPAA covered entity (health plans and most healthcare providers) within 30 days, with the possibility of one 30-day extension and for a reasonable, cost-based fee. OCR enforces the HIPAA Privacy Rule, which establishes national standards to protect individuals’ medical records; sets limits and conditions on the uses and disclosures of protected health information; and gives individuals certain rights, including the right to timely access and to obtain a copy of their health records.
