Concentra Settles Alleged HIPAA Right of Access Violation for $112,500
The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has announced its 21st financial penalty of the year to resolve an alleged violation of the HIPAA Rules, and its 54th financial penalty under its HIPAA Right of Access enforcement initiative. Concentra Inc. has agreed to pay a $112,500 financial penalty to settle OCR’s case, although it disputed the findings of OCR’s investigation.
The HIPAA Right of Access is a HIPAA Privacy Rule provision that requires covered entities to provide an individual or their personal representative with a copy of that individual’s protected health information (PHI) in a designated record set in response to a request for access. HIPAA-covered entities are only permitted to charge a reasonable, cost-based fee for providing a copy of the requested records. The requested PHI must be provided in a timely manner, and no later than 30 days from the date the request is received. In certain circumstances, a 30-day extension to that time frame is permitted.
The Concentra investigation was launched by OCR in response to a complaint from a patient who claimed not to have been provided with the requested medical and billing records within 30 days. The patient had sent multiple requests for the records in electronic format, but they failed to be provided. OCR’s investigation determined that the initial request was sent to Concentra on February 15, 2018. The request was received by Concentra’s Peoria, Arizona Center, and a Concentra employee sent the access request to its central billing office (CBO). Multiple requests were sent by the patient to the same office later in the year, but the records were not provided.
OCR’s investigation found that Concentra’s business associate invoiced for $82.57 on October 8, 2018, to provide the requested records. The invoice was disputed, and it was reduced to $6.50. The invoice was paid, and the requested records were mailed in paper form on March 19, 2019, more than one year after the initial request was sent. OCR determined that there had been a violation of the HIPAA Right of Access, as the requested records were not provided within the permitted 30 days. OCR notified Concentra, which disputed OCR’s determination. OCR proposed a financial penalty of $250,000, and Concentra requested a hearing with an Administrative Law Judge; however, prior to the hearing, both parties agreed to settle the alleged violation for a reduced penalty amount, with no admission of wrongdoing.
“Under the HIPAA Privacy Rule, individuals or their personal representatives have the right to timely access their medical records,” said OCR Director Paula M. Stannard. “Individuals should not have to make multiple requests and file a complaint with OCR to gain access to their health information.”
