OCR Settles HIPAA Right of Access Case with Memorial Health System for $60,000
It has been a busy year of HIPAA enforcement by the HHS’ Office for Civil Rights (OCR). OCR Director Melanie Fontes Rainer recently confirmed that OCR closed 22 HIPAA violation cases in 2024 with settlements or civil monetary penalties. The latest settlement was agreed with the Florida health system, South Broward Hospital District, which does business as Memorial Healthcare System, to resolve an alleged violation of the HIPAA Right of Access of the HIPAA Privacy Rule.
OCR investigated Memorial Healthcare System after receiving a complaint from a patient who alleged he had not been provided with an EEG tracing he had requested more than 30 days previously. The patient alleged he had asked for a copy of the EEG tracing on April 26, 2021, and a complaint was filed with OCR on June 23, 2021. OCR found that in addition to sending a written request for the records via the postal service on April 26, 2021, the patient had requested the records via the patient portal on April 25, 2021, and also via the portal on December 30, 2020. The EEG tracing was provided to the patient on September 29, 2021.
Memorial Healthcare System had previously provided a copy of the EEG tracing to the patient after he made a separate request; however, it did not respond to the December 30, 2020, request or any of the subsequent requests, including a follow-up request made via the patient portal on May 23, 2021. The requested records were only provided after OCR got involved. OCR determined that the failure to provide the records was a violation of the HIPAA Right of Access, although Memorial Health System maintained that there was no violation since a copy of those records had been provided to the patient prior to the December 30, 2021, request.
Memorial Healthcare System was informed by OCR of its intention to impose a $100,000 civil monetary penalty; however, Memorial Healthcare System did not agree with OCR’s determination and requested a hearing with an Administrative Law Judge. With litigation pending, OCR and Memorial Healthcare System negotiated a settlement with no admission of wrongdoing by Memorial Healthcare System. The settlement involves a $60,000 financial penalty and an agreement that the request for a hearing will be withdrawn. The settlement was agreed to avoid the time and cost of litigation.
