OCR Announces $70,000 Settlement with Sharpe Healthcare to Resolve HIPAA Right of Access Case
Sharpe Healthcare has agreed to settle a HIPAA violation case with the Department of Health and Human Services’ Office for Civil Rights and will pay a financial penalty of $70,000.
In late 2019, OCR announced a new HIPAA enforcement initiative to address noncompliance with the Right of Access provision of the HIPAA Privacy Rule. This provision gives individuals the right to obtain and inspect their medical records. Access must be provided within 30 days of an individual submitting a written request to their healthcare provider.
OCR had become aware than many healthcare providers were not providing individuals with timely access to their medical records for a reasonable cost-based fee and made enforcement of compliance a priority. Since the enforcement initiative was launched, OCR has settled sixteen cases where healthcare providers have failed to provide requested medical records within 30 days, either to the patient directly, to their nominated representative, or to a third party such as an attorney.
OCR investigated Sharpe Healthcare following a complaint from an individual who alleged he had requested his medical records be sent to a third party. The complaint was filed with OCR on June 11, 2019, more than two months after he had submitted a request to Sharpe HealthCare – doing business as Sharp Rees-Stealy Medical Centers (SRMC).
The complainant had initially submitted a request to SRMC on April 2, 2019. OCR intervened and provided technical assistance to SRMC on the HIPAA Right of Access and closed the case on June 25, 2019. The complainant filed a second complaint with OCR on August 19, 2019 as he had still not been provided with a copy of his requested records. OCR reopened the case and the complainant received the requested records on October 15, 2019.
When copies of medical records are provided 5 months after the maximum time frame for honoring a request, and two months after OCR intervened and provided technical assistance, a financial penalty can be expected.
OCR determined that the delay was a violation of the HIPAA Privacy Rule (45 C.F.R. § 164.524). Sharpe Healthcare decided not to contest the case and settled with no admission of liability. The settlement also requires Sharpe HealthCare to adopt a corrective action plan which involves developing and implementing policies and procedures in line with 45 C.F.R. §. OCR created the Right of Access Initiative to enforce and support this critical right,” said Acting OCR Director Robinsue Frohboese.
This is the fourth HIPAA settlement to resolve an enforcement action in 2020 and the third to resolve a case involving a violation of the HIPAA Right of Access.