The U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) is continuing to crack down on noncompliance with the HIPAA Right of Access and has recently announced another financial penalty has been imposed for noncompliance – The 44th penalty to be imposed since OCR launched its HIPAA Right of Access enforcement initiative in the fall of 2019.
The latest fine was imposed as part of a settlement with a licensed therapist in Pennsylvania who is alleged to have failed to provide a father with timely access to the medical records of his minor children. The failure to provide the requested medical records was a potential violation of the Right of Access provision of the HIPAA Privacy Rule.
The HIPAA Right of Access grants individuals the right to obtain a copy of their medical records within 30 days of a request being submitted. Records must also be provided, per an access request, to the personal representative of a patient. In certain limited circumstances, a 30-day extension can be granted but no longer.
David Mente, MA, LPC, has a practice in Pittsburg, PA, and his office is a covered entity under HIPAA. In December 2017, OCR received a complaint about Mente alleging he was not complying with the HIPAA Privacy Rule, as he refused to provide a father with a copy of his children’s records, even though he was permitted under the HIPAA Privacy Rule to obtain a copy of the records. OCR contacted Mente in response to the complaint and provided technical assistance on the HIPAA Right of Access and the case was closed.
A second complaint was filed with OCR on May 2, 2018, when the father had still not been provided with the requested records. OCR reopened the case and notified Mente on August 2, 2018, about the investigation into noncompliance with the HIPAA Privacy Rule. OCR’s investigators determined that the failure to provide the requested records was a potential violation of 45 C.F.R. § 164.524. Mente agreed to settle the case with no admission or wrongdoing and paid a $15,000 financial penalty. The settlement includes a corrective action plan that requires Mente to ensure that policies are developed, implemented, and maintained regarding the HIPAA Right of Access.
“Under HIPAA, parents, as the personal representatives of their minor children, generally have a right to access their children’s medical records,” said OCR Director Melanie Fontes Rainer. “It should not take an individual or their parent representative nearly six years and multiple complaints to gain access to patient records. HIPAA-regulated entities should be proactive and work to ensure patients and their representatives can access records.”