Optum Medical Care of New Jersey Settles HIPAA Right of Access Investigation for $160K
The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has announced a settlement has been agreed to resolve violations of the HIPAA Right of Access – Its 46th enforcement action under the HIPAA Right of Access enforcement initiative that was launched in late 2019. The latest penalty resolves multiple alleged failures to provide patients with timely access to their medical records.
Optum Medical Care of New Jersey is a multi-specialty physician group that serves patients in New Jersey and Southern Connecticut. OCR launched an investigation after receiving 6 individual complaints from Optum Medical Care patients who claimed they had not been provided with their requested records. The complainants were a combination of patients looking to obtain a copy of their own health records and parents seeking access to the medical records of their minor patients.
The HIPAA Right of Access allows individuals to obtain a copy of their medical records and to only be charged a reasonable, cost-based fee. Records can be inspected and requests can be made to have any errors corrected. The records should be provided in the requested format, provided the holder of those records has the technical capability to provide the records in the requested format. When a request is received, the records must be provided within 30 days, although a 30-day extension is permitted in certain situations. The HHS is seeking to reduce that time frame to 15 days.
OCR’s investigation confirmed that the records were provided, as requested, but it took Optum between 84 days and 231 days to provide the records – well outside of the maximum time permitted by HIPAA. Optum chose to settle the alleged violations with no admission of wrongdoing and paid a financial penalty of $160,000. Optum has also agreed to adopt a corrective action plan to address the alleged areas of compliance and will be monitored by OCR for 1 year. This is the 13th settlement agreed by OCR in 2023 to resolve alleged HIPAA violations.
“Health care providers must make responding to parents’ or patients’ request for access to their medical records in a timely manner a priority,” said OCR Director Melanie Fontes Rainer. “Access to medical records is a fundamental right under HIPAA, and one for which OCR receives thousands of complaints each year. This is the law—providers must proactively respond to record requests and ensure timely access. Access to medical records empowers patients and their families to make decisions about their health care and improve their health overall. It is critical that providers follow the law.”