OCR Imposes $100,000 Civil Monetary Penalty on New Jersey Nursing Facility for HIPAA Right of Access Violation
The HHS’ Office for Civil Rights has announced that Essex Residential Care, LLC has been ordered to pay a $100,000 civil monetary penalty for failing to provide a son with timely access to his mother’s medical records.
Essex Residential Care, which does business as Hackensack Meridian Health, West Caldwell Care Center, is a New Jersey nursing facility that provides long-term care and rehabilitation services. As a HIPAA-covered entity, Hackensack Meridian Health is required to comply with the Rules of the Health Insurance Portability and Accountability Act (HIPAA). OCR received a complaint from the son of a patient of Hackensack Meridian Health who alleged he had not been provided with a copy of his mother’s medical records, when he was authorized to receive those records as his mother’s personal representative.
The complainant first requested a copy of the records via email on April 19, 2020, and on April 22, 2020, that request was denied. An administrative assistant required a copy of a power of attorney, medical proxy, or similar document executed by the mother establishing that he is her personal representative. The complainant provided the appropriate power of attorney document but was still denied a copy of his mother’s records and filed a complaint with OCR on May 19, 2020.
OCR notified Hackensack Meridian Health on October 15, 2020, that it was investigating the complaint and Hackensack Meridian Health acknowledged that it had failed to provide the requested records within the 30 days allowed by the HIPAA Privacy Rule. A compliant response would have required the records to be provided no later than May 23, 2020, and they were not provided until December 1, 2020, 161 days after the initial request.
OCR notified Hackensack Meridian Health about the findings of its investigation and offered to settle the matter informally; however, Hackensack Meridian Health disagreed with OCR’s proposed resolution. Hackensack Meridian Health provided evidence of mitigating factors, confirmed that the request should have been handled differently, and waived its right to a hearing. OCR determined that between June 23, 2020, and December 1, 2020, the complainant was not provided with the requested records, which was a violation of 45 C.F.R. § 164.524(a), and a civil monetary penalty was calculated based on the reasonable cause tier.
“A patient’s timely access to health records is paramount for medical care. The Office for Civil Rights continues to receive complaints from individuals and personal representatives on behalf of individuals who do not receive timely access to their health records,” said OCR Director Melanie Fontes Rainer. “OCR will continue to vigorously enforce this essential right to ensure compliance by health care facilities across the country.”
This is the 48th OCR investigation of a HIPAA-regulated entity that has resulted in a financial penalty for a HIPAA Right of Access violation and is OCR’s 4th financial penalty of 2024.