Blog

Health Law News

Print PDF

OCR Settles Another HIPAA Right of Access Investigation Regarding Personal Representative

Posted on December 22, 2022 in Health Law News

Published by: Hall Render

On December 15, 2022, the Office for Civil Rights (“OCR”) at the U.S. Department of Health and Human Services (“HHS”) settled its investigation of a potential Health Insurance Portability and Accountability Act (“HIPAA”) violation by a primary care provider in Florida. Following the announcement of 3 right of access investigation resolutions on September 20, 2022 (referenced here), this announcement brings the total number of OCR’s Right of Access Initiative enforcement actions to 42.

This settlement arose from a complaint filed with OCR in November 2019 by the daughter of a deceased patient who claimed that the covered entity that treated her father did not provide her timely access to her father’s medical records. The daughter submitted a records access request to the covered entity in August 2019 that included evidence of her status as a personal representative but did not receive the records requested until January 2020, approximately 5 months after her request and following her complaint to OCR. OCR’s investigation resulted in a Resolution Agreement and Correction Action Plan, with the covered entity agreeing to pay HHS $20,000 and to take corrective actions to comply with the HIPAA right of access standard, including developing and implementing right of access policies and procedures, distributing said policies and procedures, training personnel on said policies and procedures and agreeing to report known violations to HHS. The covered entity was also required to provide HHS with an implementation report within 120 days of HHS’s approval of its policies and procedures, as well as annual reports on its continued progress with the corrective action plan during the 2-year period for compliance.

More Information

Please view our comprehensive article on OCR’s Right of Access Initiative here, which includes a summary of the HIPAA compliance requirements and a deeper dive into lessons learned from the enforcement activity to date.

Questions

If you have any questions or would like additional information about this topic, please contact:

Hall Render blog posts and articles are intended for informational purposes only. For ethical reasons, Hall Render attorneys cannot give legal advice outside of an attorney-client relationship.