OCR Settles HIPAA Right of Access Investigation with Phoenix Healthcare for $35,000
The Department of Health and Human Services’ Office for Civil Rights (OCR) has announced that a $35,000 settlement has been reached with Phoenix Healthcare to resolve a HIPAA Right of Access violation. This is the 47th investigation of a HIPAA Right of Access case to result in a financial penalty. The HIPAA Right of Access provision of the HIPAA Privacy Rule requires patients or their personal representatives to have timely access to their health information. Access/copies of the requested information must be provided within 30 days of the request being received.
OCR received a complaint from a daughter whose mother was a patient of Phoenix Healthcare, an Oklahoma multi-facility organization that provides nursing care. The daughter was the personal representative of her mother and had not been provided with timely access to her mother’s medical records. The daughter requested the records on multiple occasions and had to wait almost a year to receive the requested data. The requested records were provided 323 days after the initial request was made.
The daughter reported the matter to OCR as a potential HIPAA investigation and OCR launched an investigation. OCR determined that there had been a violation of the HIPAA Right of Access and informed Phoenix Healthcare by letter on March 30, 2021, of its intention to impose a financial penalty of $250,000 for the failure to comply with the HIPAA Right of Access provision of the HIPAA Privacy Rule. Phoenix Healthcare contested the proposed fine and requested a hearing before an Administrative Law Judge (ALJ). The ALJ upheld the violations cited by OCR and that there had been wilful neglect of the HIPAA Privacy Rule. The ALJ ordered Phoenix Healthcare to pay a civil monetary penalty of $75,000.
Phoenix Healthcare appealed the $75,000 penalty, contesting both the penalty amount and the wilful neglect determination. The Departmental Appeals Board affirmed the ALJ’s decision that there had been wilful neglect of the HIPAA Rules and order to pay $75,000; however, OCR chose to settle with Phoenix Healthcare and reduced the financial penalty to $35,000 on the condition that the Departmental Appeals Board’s decision is not challenged, that Phoenix Healthcare revises its HIPAA policies and procedures, and provides HIPAA training on the revised policies and procedures to its workforce.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
“Patients need to make the best decisions possible for their health and well-being, so timely access to their medical records is imperative,” said OCR Director Melanie Fontes Rainer. “Without this access, patients are at risk for incorrect treatments, inaccurate health records, and lack of understanding of their health conditions. It is unacceptable for a health care provider to delay or deny requests to release medical records for months, and we are calling on providers everywhere to be compliant to help empower patients.”
This is the third OCR HIPAA investigation of 2024 to result in a financial penalty, the others being a $4,750,000 settlement with Montefiore Medical Center, and a $40,000 settlement with Green Ridge Behavioral Health.
