Oregon Health & Science University Fined $200,000 for HIPAA Right of Access Failure
Oregon Health & Science University has been fined $200,000 by the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) for failing to provide a patient’s personal representative with a full set of the patient’s medical records in a timely manner. The HIPAA Privacy Rule requires HIPAA-covered entities to provide patients with a copy of their requested health records within 30 days of a request being submitted, although a 30-day extension can apply in certain circumstances.
A request was received by Oregon Health & Science University on April 24, 2019, and while some records were provided by the vendor (Diversified Business Services) that handled its medical record requests within a week of the request being received, a full set of the requested records was not provided. The patient’s representative sent a second request to Oregon Health & Science University on November 12, 2019; however, the request was denied due to a technical issue. A third request was sent on May 20, 2020, and a complaint was filed with OCR on the same date. Oregon Health & Science University provided a partial set of records on May 29, 2020, but since some of the requested records were still missing, another request was sent on July 24, 2020. That request was denied.
In response to the complaint, OCR provided technical assistance to Oregon Health & Science University on the HIPAA Right of Access and closed the complaint on September 2, 2020. On January 27, 2021, the patient’s representative filed a second complaint with OCR. OCR notified Oregon Health & Science University about the second complaint on August 12, 2021, and on August 26, 2021, the patient’s representative was provided with all of the requested records, with additional records provided on September 29, 2021.
OCR determined that the 16-month delay in providing the records, which included two erroneously denied requests, was a violation of the HIPAA Right of Access. Oregon Health & Science University was informed about OCR’s intention to impose a financial penalty and was given the option of settling the alleged violation informally; however, when that offer was not taken up, OCR moved to impose a civil monetary penalty of $200,000. Oregon Health & Science University waived its right to a hearing and did not contest the civil monetary penalty.
This is the second civil monetary penalty to be announced by OCR this year, and follows a $1.5 million civil monetary penalty for Warby Parker, Inc. last month to resolve multiple violations of the HIPAA Security Rule. These fines show that under the leadership of Acting Director Anthony Archeval, OCR is keen to hold HIPAA-regulated entities to account for compliance failures. Under the previous administration, OCR announced 6 settlements in 2025 to resolve alleged HIPAA violations.
“The HIPAA Privacy Rule requires that individuals and their personal representatives receive timely access to their medical records,” said OCR Acting Director Archeval. “A covered entity’s responsibility to provide timely access continues, even when a covered entity contracts with a business associate to respond to HIPAA right of access requests.”
