American Medical Response Pays $115K Civil Monetary Penalty for HIPAA Violation
American Medical Response (AMR), a private ambulance company, has paid a $115,200 civil monetary penalty to the HHS’ Office for Civil Rights (OCR) to resolve a violation of the HIPAA Right of Access. AMR failed to provide a patient with timely access to their medical records, taking more than a year to provide the requested records.
The HIPAA Right of Access is an important provision of the HIPAA Privacy Rule and requires patients to be provided with a copy of their records, on request, within 30 days of submitting that request. In certain circumstances, a 30-day extension is permitted. The fine relates to American Medical Response Ambulance Service, a subsidiary of American Medical Response and a HIPAA-covered entity.
On October 31, 2018, the affected party sent a written request to AMR by fax requesting a copy of her medical records, specifically all billing records pertaining to treatment rendered for a 9/15/2015 injury date, patient balance verification, and all medical records pertaining to treatment rendered for the 9/15/2015 injury. She requested those records be provided in electronic format. Those records should have been provided by November 30, 2018.
Follow-up requests were sent by the affected party on January 24, 2019, to AMR’s Los Angeles office and its business associate Centrex. AMR responded to the request on March 1, 2019, 121 days after the initial request was submitted. That response was an invoice, which AMR said had to be paid before the records could be released. The affected party sent a further follow-up to AMR on March 18, 2019, demanding the records be provided or a complaint would be filed with OCR. The complaint was filed with OCR on July 29, 2019. The records were finally provided to the affected party on November 5, 2019, 370 days after the initial request.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
OCR’s investigation determined that there had been a violation of the HIPAA Right of Access and AMR was given the opportunity to settle the case. AMR’s legal counsel asked OCR to reconsider its position but failed to provide any counteroffer or otherwise engage in negotiations. OCR sent a letter of opportunity advising AMR that it could submit written evidence of mitigating factors; however, OCR determined that AMR’s arguments did not support an affirmative defense to support a waiver of the civil monetary penalty.
This is the 47th financial penalty to be imposed by OCR to resolve a HIPAA Right of Access violation, and it is one of the largest penalties imposed for this type of violation. The HIPAA violation penalty tier was reasonable cause, with the penalty amount calculated on a daily basis from December 1, 2018, to February 28, 2019. AMR had policies and procedures in place for handling requests from individuals for copies of their medical records and has now revised those policies and procedures to ensure they are handled more efficiently.
“HIPAA gives patients a right to timely access to their medical records,” said OCR Director Melanie Fontes Rainer. “OCR will continue to enforce this right through investigations, and when necessary, by imposing civil money penalties.”
