OCR Continues HIPAA Right of Access Crackdown with $200,000 Fine
The HHS’ Office for Civil Rights (OCR) is continuing to crackdown on healthcare providers that are not providing patients with timely access to their medical records. Yesterday, OCR announced a settlement had been agreed with Banner Health to resolve a HIPAA Right of Access investigation. Banner Health agreed to pay $200,000 to settle the case.
The HIPAA Privacy Rule gives individuals the right to access, inspect, and obtain a copy of their own protected health information. When a request is received, HIPAA-covered entities are required to provide a copy of the requested records within 30 days.
In late 2019, OCR announced it was cracking down on noncompliance with this important provision of HIPAA. Since then, 14 financial penalties have been imposed on covered entities that have failed to provide patients with timely access to their medical records.
Phoenix, AZ-based Banner Health is one of the largest health care systems in the United States. The non-profit health system operates 30 hospitals and many primary care, urgent care, and specialty care facilities.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
OCR received two complaints from patients of Banner Health affiliated covered entities alleging long delays receiving copies of medical records. The first patient submitted a request to Banner Estrella Medical Center in December 2017 and was not provided with the requested records until May 2018. A second complaint was received alleging another patient had to wait 5 months for an electronic copy of his records. The request was submitted to Banner Gateway Medical Center in September 2019 and he did not receive the records until February 2020.
The $200,000 financial penalty is the largest HIPAA fine imposed on a HIPAA-covered entity by OCR under its HIPAA Right of Access enforcement initiative. In addition to paying the financial penalty, Banner Health has agreed to adopt a corrective action plan that includes reviewing and revising written policies on health record access, implementing those policies, and providing training to staff on the new policies. OCR will monitor Banner Health for 2 years to ensure compliance.
“This first resolution of the year signals that our Right of Access Initiative is still going strong and that providers of all sizes need to respect the right of patients to have timely access to their medical records,” said OCR Director Roger Severino.
