Privacy & Cybersecurity Law Blog

The U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights (“OCR”) recently announced more settlements associated with its HIPAA Right of Access Initiative. The settlements with Village Plastic Surgery ("VPS") and The Arbour, Inc. (“Arbour”) resulted in combined civil monetary penalties of $95,000.

These latest actions bring the total number of actions taken by OCR under the HIPAA Right of Access Initiative to 18 and collectively have resulted in over $1 million in settlements. This amounts to an average of approximately one action per month since the first settlement in September 2019. Generally, enforcement actions under the HIPAA Right of Access Initiative have occurred more swiftly than other HIPAA enforcement actions following information security breaches.

Acting OCR Director Robinsue Frohboese stated, “OCR’s Right of Access Initiative continues to support and enforce individuals’ vital right to receive copies of their medical records in a timely manner. Covered entities must comply with their HIPAA obligations and OCR will take appropriate remedial actions if they do not.”