Californian Mental Health Center Fined $100,000 for HIPAA Violation
The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has imposed a $100,000 civil monetary penalty on a Californian mental health center for failing to provide a patient with timely access to her medical records.
On March 18, 2020, a patient of Rio Hondo Community Mental Health Center, a directly operated Outpatient Program of the County of Los Angeles Department of Mental Health, visited the clinic and completed a medical record request form. The patient should have been provided with a copy of the requested records within 30 days, but the requested records were not provided until 7 months after the initial request was made.
There was an initial delay of 2 months as California Governor Gavin Newsom issued a stay-at-home order on March 19, 2020, the day after the request was made. All County buildings were closed to the public and there was little to no staff working at the clinics at that time. Staff started to return to the clinic in May 2020, and on May 22, 2020, the patient was informed in a phone call that she could collect her records on May 27, 2020.
When the patient turned up at Rio Hondo on May 27, she waited 20 minutes but was not seen, then left her contact information and asked to be contacted when her records were ready to be collected. The records had still not been provided by July 17, 2020, so the patient called Rio Hondo several times that day and was transferred to the medical record department but the calls were not answered.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The patient called Rio Hondo on several occasions in August 2020 and did manage to speak to a member of staff, but there was no follow-up. On August 21, 2020, the patient filed a complaint with OCR. On October 7, 2020, OCR contacted Rio Hondo regarding the complaint. Rio Hondo called the patient that day, and again on October 8 and October 16, and left voicemails for the patient, then sent a letter of apology on October 19, 2020, and sent the requested records by certified mail the following day.
OCR investigated and was informed that the Intermediate Typist Clerk (ITC) assigned to respond to medical record requests was alerted when the patient arrived at the clinic on May 27 but delayed the meeting to consult with multiple colleagues about how to process the record access request. The ITC said one attempt was made to contact the patient when she learned that the patient had left the clinic, but there were no further follow-ups. The ITC confirmed that she was notified about the patient’s calls on July 17, but could not recall if she or any other staff member returned the patient’s calls.
OCR notified Rio Hondo about the findings of the investigation on August 31, 2022, and that the failure to provide a timely copy of the medical records was a violation of the HIPAA right of access, and Rio Hondo was given the opportunity to settle the matter informally. Rio Hondo was notified on February 3, 2023, that no attempt had been made to settle the matter informally, and was provided with an opportunity to submit written evidence of mitigating factors.
Rio Hondo responded and explained that the records could not be processed in the first 60 days due to the stay-at-home order, and after that date, several attempts were made to contact the patient but the patient did not respond. Rio Hondo also confirmed that protocols had been changed to ensure that similar situations were prevented in the future. OCR determined that the submitted evidence did not support a waiver of a civil monetary penalty, and imposed a $100,000 penalty for the 156 days that the records were not provided from May 17, 2020, to October 20, 2020. The calculated penalty was $215,124, which was capped at $100,000 per OCR’s 2019 notice of enforcement discretion.
“Patients should never be in the position of needing to request their own medical records over and over again before getting access to them,” said OCR Director Melanie Fontes Rainer. “Ensuring patients’ rights to timely access to medical information continues to be a HIPAA enforcement priority. Healthcare providers are legally obligated to provide patients with timely access to their medical records. If they fail to provide that access, OCR will not hesitate to do everything in its power, including imposing civil monetary penalties, to ensure compliance with the law.”
This was the 51st financial penalty imposed by OCR to resolve an alleged violation of the HIPAA Right of Access, and its 12th financial penalty of the year to resolve noncompliance with the HIPAA Rules.
