Privacy & Cybersecurity Law Blog

On September 15, 2020, the U.S. Department of Health and Human Services’ (“HHS”) Office for Civil Rights (“OCR”) announced five more settlements under its HIPAA Right of Access Initiative. The OCR announced its Right of Access Initiative in 2019, promising vigorous enforcement of HIPAA’s access rules. The five newly announced settlements bring OCR's total to seven completed enforcement actions under the Right of Access Initiative.

These settlements were with Housing Works Inc., All Inclusive Medical Services Inc., Beth Israel Lahey Health Behavioral Services, King MD and Wise Psychiatry PC. Each agreed to adopt a corrective action plan to settle its potential violation of HIPAA’s right of access provision and pay OCR amounts ranging from $3,500 to $70,000.

The HIPAA Rules generally require covered health care providers to provide medical records within 30 days of the access request in a readily producible format of the patient’s choosing (and providers are only permitted to charge a reasonable cost-based fee). In the announcement this week, OCR Director Roger Severino stated, “Patients can't take charge of their health care decisions, without timely access to their own medical information. [The] announcement is about empowering patients and holding health care providers accountable for failing to take their HIPAA obligations seriously enough.”