The Omaha, Nebraska-based pediatric care provider Children’s Hospital & Medical Center (CHMC) has agreed to pay a $80,000 financial penalty to resolve an investigation into an alleged violation of the Right of Access provision of the HIPAA Privacy Rule.
The Privacy Rule established certain rights for individuals over their healthcare data, one of which allows individuals to obtain a copy of their medical records from HIPAA-covered entities, as well as the records of their minor children. This is an important right, as it allows patients to check their medical records for errors and easily share their medical records with third parties, be they friends, family members, lawyers, or different healthcare providers.
Under the HIPAA Privacy Rule, covered entities are required to provide the requested records within 30 days of a written request being received, although it is possible in certain cases for a 30-day extension to be granted for providing the records. Covered entities are only permitted to charge a reasonable cost-based fee for providing those records.
After identifying several instances where HIPAA-covered entities were not providing individuals with timely access to their medical records, OCR launched a new HIPAA enforcement initiative in the fall of 2019 targeting noncompliance with the HIPAA Right of Access. The latest case is the 20th investigated by OCR that has resulted in a financial penalty to resolve an alleged HIPAA Right of Access violation. In all cases so far, the investigations were launched after complaints were received from individuals who had not been provided with their requested records within the allowed time frame.
The CHMC investigation was triggered following a complaint from a parent who alleged she had not been provided with a complete set of her late daughter’s medical records. The daughter was a minor and the parent was the personal representative of her daughter, so had a legitimate right to obtain the records. The parent had made a written request for her daughter’s medical records on January 3, 2020 but had only been provided with some of the requested records. CHMC said the remaining records were with a different CHMC division.
It took several follow-up requests from the parent before all the requested medical records were released, some of which were provided on June 20, 2020 and the remainder on July 16, 2020.
OCR determined the delay in providing the records was a violation of the HIPAA Right of Access – 45 C.F.R. § 164.524(b) – and the case was settled by CHMC with no admission of liability. In addition to paying the financial penalty, CHMC has adopted a corrective action plan which includes reviewing and updating Right of Access policies and procedures and training employees on the new policies.
Generally, HIPAA requires covered entities to give parents timely access to their minor children’s medical records, when the parent is the child’s personal representative,” said Acting OCR Director Robinsue Frohboese. “OCR’s Right of Access Initiative supports patients’ and personal representatives’ fundamental right to their health information and underscores the importance of all covered entities’ compliance with this essential right.”
