$100,000 Financial Penalty Imposed on NY Spine for HIPAA Right of Access Failure
In 2019, the U.S. Department of Health and Human Services’ Office for Civil Rights launched its HIPAA Right of Access enforcement initiative to encourage healthcare providers to comply with this important provision of the HIPAA Privacy Rule by making noncompliance expensive.
When patients, or their nominated personal representatives, are not provided with timely access to medical records, for a reasonable cost, in the format of their choosing, financial penalties can and will be issued. The past month has seen a flurry of financial penalties for HIPAA covered entities for the failure to provide patients with a copy of their requested records.
Last week, OCR announced its 9th financial penalty under the HIPAA Right of Access initiative, and its 7th HIPAA right of access penalty in the last month.
The latest case involved NY Spine, a private medical practice specializing in neurology and pain management. NY Spine has offices in New York city and Miami.
OCR received a complaint from a patient in July 2019 who clamed that multiple requests had been submitted to NY Spine for her medical records, but the requested records had not been provided within 30 days, as is required by the HIPAA Privacy Rule. OCR investigated and determined NY Spine had responded to the patient’s request and provided some of records, but not the specific diagnostic films the patient had requested.
Thanks to the intervention of OCR, the patient was provided with all the requested information, including her diagnostic images, but did not receive all of those records until October 2020. OCR determined the 16-month delay in providing those records warranted a sizeable financial penalty. NY Spine settled the case and agreed to pay a $100,000 financial penalty and adopt a corrective action plan. OCR will monitor NY Spine for HIPAA compliance for the next two years.
“No one should have to wait over a year to get copies of their medical records. HIPAA entitles patients to timely access to their records and we will continue our stepped-up enforcement of the right of access until covered entities get the message,” said Roger Severino, OCR Director.