Mental Health Center Slapped With $100,000 HIPAA Right of Access Penalty
A Californian mental health center has been fined $100,000 for failing to provide a patient with timely access to their medical records. This is the 51st financial penalty imposed by the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) to resolve a HIPAA right of access violation and its 12th financial penalty of the year.
As was the case with previous HIPAA Right of Access penalties, the investigation was initiated after OCR received a complaint from a patient who had not been provided with their requested medical records within 30 days. The patient had previously received treatment at Rio Hondo Community Mental Health Center in Cerritos, California – a directly operated Outpatient Program of the County of Los Angeles Department of Mental Health. On March 18, 2020, the patient visited the center and completed a medical record request form in person; however, the request could not be processed in the standard time frame as the following day, California Governor Gavin Newsom issued a stay-at-home order to prevent the spread of COVID-19, and staff at the mental health center stopped working at the facility.
When the stay-at-home order was lifted, the staff started to return to the facility in May 2020, and on May 22, 2020, Rio Hondo notified the patient by telephone that she could collect the requested records on May 27, 2020. When the patient turned up on May 27 to collect her records, she waited 20 minutes before leaving her contact information and a request to be contacted when her records were ready to collect.
According to the Intermediate Typist Clerk (ITC) assigned to respond to her request, the meeting with the patient on May 27, 2020, was delayed while she consulted with multiple colleagues about how to process the request. The ITC said she attempted to contact the complainant when she learned she had left the clinic but there was no documentation to support any follow-up. On July 17, 2020, the patient called Rio Hondo several times on the phone to ask about the status of her record access request, but no one answered. The patient also claimed to have called Rio Hondo several times in August 2020 when she spoke with a member of staff but did not receive any follow-up and did not receive her records. The patient filed a complaint with OCR on August 21, 2020.
OCR notified Rio Hondo about the complaint on October 7, 2020, and the medical center immediately responded by calling the patient and leaving voicemails on October 7, 8, and 16, 2020. The requested records were sent to the patient by certified mail on October 20, 2020, 7 months after the initial request. OCR notified Rio Hondo about the failure to comply with the HIPAA right of access and provided the mental health center with the opportunity to settle the matter informally on August 31, 2022. When no attempt was made to settle the matter informally, OCR provided Rio Hondo with the opportunity to submit evidence of mitigating factors in February 2023. Rio Hondo submitted evidence; however, OCR found the information submitted did not support a waiver of a civil monetary penalty. Rio Hondo has implemented new protocols for medical record access requests to prevent similar incidents in the future.
