Memorial Healthcare System Settles Alleged HIPAA Right of Access Violation
South Broward Hospital District, a Florida health system that does business as Memorial Healthcare System, has agreed to settle an alleged violation of the HIPAA Right of Access with the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR).
The HIPAA Privacy Rule gives individuals rights over their health records, including the right to obtain a copy of those records and to only be charged a reasonable cost-based fee. When a HIPAA-regulated entity receives a request, the records must be provided within 30 days, or in limited circumstances, a 30-day extension is possible. OCR received a complaint from a patient on June 23, 2021, who alleged he had submitted a request to Memorial Healthcare System on April 26, 2021, for a copy of specific health records but those records had not been provided.
OCR investigated and found that while the patient had mailed a written request for the records on April 26, 2021, it was not the first time the records had been requested. The patient had requested a copy of an EEG tracing via the Memorial Healthcare System patient portal on December 30, 2020, and then sent a second request for those records via the patient portal on April 25, 2021. The patient also sent a follow-up request for the EEG tracing on May 23, 2021.
Memorial Health System provided the patient with a copy of the requested records, but only after OCR had initiated its investigation. The patient received the requested records on September 29, 2021, 9 months after the initial request was made. OCR discovered that Memorial Healthcare System had provided the EEG tracing to the patient on one previous occasion; however, failed to respond to the December 30, 2020, request and the subsequent requests.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
OCR proposed a civil monetary penalty of $100,000 to resolve an alleged HIPAA Right of Access violation. Memorial Health System contested the findings and requested a hearing before an Administrative Law Judge, and while the matter was docketed before the Civil Remedies Division of the Departmental Appeals Board, OCR and Memorial Healthcare System engaged in settlement negotiations and agreed to settle the alleged violation. Under the terms of the settlement, Memorial Health System has agreed to pay a $60,000 financial penalty to resolve the pending litigation.
