OCR Imposes $80,000 Fine on Nebraska Hospital for HIPAA Right of Action Violation
Children’s Hospital & Medical Center (CHMC) has agreed to settle a HIPAA Right of Access investigation with the Department of Health and Human Services’ Office for Civil Rights (OCR) and will pay a $80,000 fine to resolve the case.
CHMC is a pediatric care provider based in Omaha, Nebraska. On January 3, 2020, a parent submitted a written request to CHMC for a copy of her late daughter’s medical records. CHMC provided the parent with some of the records she requested but was unable to provide all of the records as some needed to come from a different CHMC division. The parent did not receive all the requested records within the 30 days permitted by the HIPAA Privacy Rule and had to make several follow-up requests to CHMC for the records that had not been provided.
After receiving a complaint from the parent, OCR launched an investigation into the alleged HIPAA Right of Access violation and determined the delay in providing the requested records was in violation of 45 C.F.R. § 164.524(b) of the HIPAA Privacy Rule, which allows covered entities 30 days to provide requested medical records to individuals, or up to 60 days under certain circumstances if an extension is requested. In the case of CHMC, some of the requested records were provided on time, some on June 20, 2020, and the rest on July 16, 2020.
CHMC settled the investigation with no admission of liability. In addition to paying the $80,000 financial penalty, CHMC will adopt a corrective action plan that includes revising policies and procedures related to medical record access requests and providing HIPAA training on the policies and procedures to members of its workforce. OCR will monitor CHMC for compliance with the HIPAA Right of Access for a period of one year.
Since OCR launched its HIPAA Right of Access initiative in the fall of 2019 there have been 20 investigations that have resulted in financial penalties.
“Generally, HIPAA requires covered entities to give parents timely access to their minor children’s medical records, when the parent is the child’s personal representative,” said Acting OCR Director Robinsue Frohboese. “OCR’s Right of Access Initiative supports patients’ and personal representatives’ fundamental right to their health information and underscores the importance of all covered entities’ compliance with this essential right.”
