Right of Access

The Price of Delay: A Costly HIPAA Lesson
Fines, HIPAA

The Price of Delay: A Costly HIPAA Lesson

December 2, 2024 No comments yet

December 2, 2024 Over a million dollars in HIPAA fines have been levied in the past few months, and like this winter’s snow, the fines continue to pile up, with a $100,000 fine recently announced. Last week, Rio Hondo Community Mental Health Center, an outpatient program managed by the Los Angeles Department of Health, was fined for a Right of Access violation. This marks the 51st enforcement of the Right of Access rule, highlighting the importance of handling patient records in a timely manner. What Happened? A patient requested a copy of their records on March 18, 2020. As we all know, March 2020 was marked by the beginning of the unprecedented COVID-19 virus, which led to the mental health center’s closure after the Governor of California put into action a “stay-at-home” order. However, the center reopened at the beginning of May 2020, allowing some staff to return to the facility. While the patient was told her records would be ready at this time, she was misinformed and began the summer with a flurry of calls and other forms of contact to request her medical records. After her requests were unfulfilled several times, the patient filed a complaint with the Office for Civil Rights (OCR) at the end of August 2020. The OCR then began investigating the Rio Hondo at the beginning of October. The medical records were finally sent on October 20, 2020, 216 days after the first request. The Right of Access rule requires Covered Entities to provide patients with their medical records within 30 days of the initial request. While the medical center was under a “stay-at-home” order during those 30 days, this was still significantly longer than the extension period of an additional 30 days and could have been handled when it was first deemed safe for staff to return to the medical center. This fine comes after a series of Right of Access fines, including another significant fine of $70,000 imposed at the end of October. The numerous fines issued this past year regarding the Right of Access initiative demonstrate the government’s commitment to this important aspect of patients’ rights. Protect Your Practice from Costly Mistakes Even during the peak of the global health crisis, HIPAA regulations stayed in effect. Implementing software solutions can help safeguard your practice. To ensure your staff remains compliant, it is highly recommended to use automated software that keeps you and your team in check, regardless of the circumstances. Schedule a consultation today to learn more about automated compliance for your practice.

Patient Record Access HIPAA Fine
Fines, HIPAA

Expensive Oversight: The Importance of Timely Patient Record Access

October 24, 2024 No comments yet

October 24, 2024 There has been a flurry of HIPAA fines in the past few weeks, with over half a million dollars levied in the last month.  Just one example is Gums Dental Care, LLC, a small dental practice in Maryland that was fined for a Right of Access violation. Right of Access violations, which involve failing to provide medical records in a timely manner, are a common HIPAA mistake. Another violation for this was issued in August.   What Happened?  A patient requested her medical records from Gums Dental on April 8, 2019. After not receiving them, she issued a complaint to the OCR in May 2019. The OCR contacted Gums Dental Care for technical assistance and believed the case was over.  This was just the beginning. This case spanned years, with a second complaint filed in August 2019 and the OCR sending several data requests through letters and calls to Gums Dental.  On October 1, 2020, the OCR sent Gums Dental a proposed resolution agreement and corrective action plan. At the end of the month, Dr. Gums wanted to present her case in front of a judge, believing the patient would commit Medicaid fraud with her records. She also said that the complainant didn’t pay a $25 administrative fee to release the medical records through mail. First, patients should always have access to their medical records, regardless of their reasons. Second, the fee would be waived if the patient requested it digitally, not through mail.   In December 2020, the OCR issued a Letter of Opportunity to Gums Dental. At the beginning of the next year, Dr. Gums once again justified her refusal to provide the records since she believed her patient would commit a crime with them. She also believed her website wasn’t secure enough to send them digitally. However, Gums Dental didn’t attempt to send the records at all.  By the time the Notice of Proposed Determination was sent in March 2022, roughly three years after the first medical record request, Gums Dental faced a Civil Monetary Penalty fine as high as $7,676,692. However, the OCR ultimately levied a $70,000 fine, recognizing the smaller size of the dental practice.    How to Protect Your Practice Common HIPAA fines often involve Right of Access violations. At the federal level, practices are required to provide patients with their medical records within 30 days, and some states have an even shorter timeline. Navigating these unique regulations can be challenging, so having an intelligent solution is crucial. Smart software can streamline compliance for your practice by generating policies and procedures tailored to your needs. These solutions also include access to a team of compliance experts who can help answer your questions and ensure that you are interacting with patients in a HIPAA-compliant manner.  To learn more about software solutions, with a compliance expert here.   

American Medical Response HIPAA Fine
Fines, HIPAA

Your Medical Records, Your Right: AMR Learns Costly Lesson

August 6, 2024 Comments Off on Your Medical Records, Your Right: AMR Learns Costly Lesson

August 6, 2024 Did you know the Office for Civil Rights (OCR) has launched a new initiative to ensure proper compliance with patients’ Rights of Access? American Medical Response (AMR), a private ambulance company, has now felt the impact of these efforts, becoming the 49th entity to face a HIPAA Right of Access Enforcement Action. AMR was recently fined $115,200 for failing to provide a patient with their medical records in a timely fashion.  AMR’s mistake was brought to the attention of the OCR through a patient complaint. On October 31, 2018, the patient requested a copy of her medical records. Instead of receiving them within the allotted 30 days, this sparked the beginning of a long battle for her records.  In January 2019, the patient sent follow-up requests to both AMR and its Business Associate, Centrex. AMR responded to the request in March 2019, sending the patient an invoice and requiring payment before the records were provided.  During the ongoing battle for her medical records, she warned AMR she would report the organization to the OCR if her records were not provided. The patient filed a complaint in July 2019. Finally, the records were provided on November 5, 2019, over a year after the initial request.  What is Right of Access?  HIPAA’s Right of Access rule, which falls under the HIPAA Privacy Rule, allows patients to receive access to their medical records within 30 days with minimal or no charges. These charges can only include the costs of copying and mailing medical records. In some states, this 30-day requirement is shorter, like in California, which requires access to copies within 15 days.  This right empowers patients to make informed healthcare decisions, such as sharing their medical history with new providers. What should my practice do?  First, proper training is essential to ensure that staff understand the importance of providing patients with their records on time. Additionally, staff must understand and follow the procedures for securely sharing medical information with the patient. Ensuring staff is properly trained and aware of the resources available to them is vital to staying compliant.  You could be adding more stress to your plate if you still use a dusty binder to track and manage HIPAA compliance. Keeping track of training, documentation, and the constantly evolving regulations is a complex task that demands a modern approach. Intelligent software solutions can offer staff a centralized compliance hub with everything they need to know when navigating patient requests. To learn more about how smart compliance software solutions can protect your practice, schedule a consultation with an expert today. 

New Jersey Nursing Facility HIPAA Fine
Fines, HIPAA

HHS Cracks Down on New Jersey Nursing Facility for HIPAA Violation

April 1, 2024 Comments Off on HHS Cracks Down on New Jersey Nursing Facility for HIPAA Violation

April 1, 2024 The U.S. Department of Health and Human Services (HHS) has imposed a civil monetary penalty of $100,000 on Hackensack Meridian Health West Caldwell Care Center, a skilled nursing facility in New Jersey. The facility violated the HIPAA Right of Access law. The penalty stems from the facility’s failure to provide a patient’s medical records to their authorized representative in a timely manner, or within 30 days.  According to the HHS Office for Civil Rights (OCR), which investigated the case, Hackensack Meridian Health withheld the records even after receiving documentation demonstrating the individual’s legal right to access them. The requested records were ultimately sent to the authorized representative only after intervention by the OCR. HIPAA guarantees patients the right to access and obtain copies of their medical records. The OCR enforces this regulation and takes action against healthcare facilities that fail to comply. “A patient’s timely access to health records is paramount for medical care,” said OCR Director Melanie Fontes Rainer in a press release. “The OCR will continue to vigorously enforce this essential right to ensure compliance by health care facilities across the country.” This incident highlights the importance of HIPAA and the rights it grants patients regarding their medical information. It also serves as a reminder for healthcare providers to ensure they have clear procedures in place for handling requests for medical records. This is also the second Right of Access violation ruled on in the last week. Read more about other recent fines here.

Phoenix Healthcare HIPAA Fine
Fines, HIPAA

Phoenix Healthcare Fine: Don’t be a Fool in Compliance

April 1, 2024 Comments Off on Phoenix Healthcare Fine: Don’t be a Fool in Compliance

April 1, 2024 Happy April Fools Day! We hope you’re enjoying the holiday with some lighthearted fun and pranks!  Now, HIPAA regulations are no laughing matter. HIPAA regulations are in place to protect patients’ information, making sure we all have the rights we deserve to keep our information safe.  Today, we’re talking about the latest HIPAA fine, given to a multi-location nursing care organization in Oklahoma, Phoenix Healthcare.  Phoenix Healthcare was fined 35 grand for violating the HIPAA Right of Access Rule, being the butt of the joke of this major fine.  Get buckled up, pranksters! We’re all in for some April Fools’ fun but don’t even think about messing with HIPAA. Patient privacy is no joke!  So, What Happened?  Well, what happened was unfortunately not a prank.  Phoenix Healthcare withheld someone’s health information for almost a year after an initial request was made.  The OCR was made aware of this not-so-funny situation by a caretaker trying to get the health information of her mother, a patient at the nursing home.  Like a joke that went on too long, Phoenix Healthcare eventually did send the information to the daughter. However, the HIPAA Right of Access Rule requires information to be shared within thirty days of a request. Some states, it’s even sooner, like California!  The daughter reported the HIPAA violation to the OCR, and at first, Phoenix Healthcare was ordered to pay a fine of 75,000! With an appeal, and an agreement that Phoenix Healthcare updates its HIPAA policies and procedures, and provides training, the fine was lowered to 35,000.  Whew! While Phoenix Healthcare is still on thin ice, they saved themselves a lot of money.  What can I learn from this?  Well, great question! First, HIPAA compliance is no joke. But don’t worry, no April Fool’s pranks here!  To stay ahead of the curve,  we can make sure your practice is up-to-date on all the HIPAA rules. That way, you can focus on the fun and leave the compliance worries to us. With Abyde, we make sure you Never Stress Over Compliance Again! The Abyde software offers a variety of features to simplify the compliance process. Yes, the words ‘simple’ and ‘compliance’ can be in the same sentence.  While this is a chore for Phoenix Healthcare, the Abyde software even includes dynamically generated policies and procedures, having HIPAA-compliant policies in seconds. The training is also covered, with our enjoyable training that somehow turns learning about HIPAA fun!  We promise you, this isn’t an April Fools trick, we actually make compliance easy. To learn more about how Abyde can help your practice, schedule a consultation, here. 

Optum Medical Care of New Jersey HIPAA Fine
Fines, HIPAA

HIPAA Fine Announced: OCR Cracks Down After Multiple HIPAA Complaints Over Patient Right of Access

January 5, 2024 Comments Off on HIPAA Fine Announced: OCR Cracks Down After Multiple HIPAA Complaints Over Patient Right of Access

January 5, 2024 Patients at Optum Medical Care in New Jersey and Connecticut had a frustrating experience: waiting months for their medical records. They requested their records, as guaranteed by the Health Insurance Portability and Accountability Act (HIPAA), but Optum dragged its feet for months, far beyond the 30-day legal limit. Fed up with the delays, several patients filed complaints with the Office for Civil Rights (OCR). The OCR investigated and found that Optum had indeed violated the law. As a consequence, Optum has been slapped with a $160,000 fine and ordered to implement a corrective action plan to speed up the record-sharing process. This case is a reminder of two important things: This case is also the 46th enforcement action taken by the OCR under its Right of Access Initiative, highlighting the importance of timely access to medical records for patients across the country. Abyde: Your Partner in HIPAA Compliance At Abyde, we recognize the stress practices undergo trying to stay in compliance. We remain committed to supporting practices in navigating the complexities of HIPAA compliance, with a specific emphasis on the importance of providing patients medical records within the allotted time frame. Contact Abyde today at info@abyde.com and set up a demo to see why Abyde is considered the pre-eminent HIPAA compliance solution.  

UnitedHealthcare Right of Access Fine
Fines, HIPAA

Sharing with the Right People is Caring – And It’s the Law: UnitedHealthcare’s $80,000 HIPAA Lesson

August 24, 2023 Comments Off on Sharing with the Right People is Caring – And It’s the Law: UnitedHealthcare’s $80,000 HIPAA Lesson

August 24, 2023 “Sharing is caring” – an age-old mantra. But in healthcare, it’s all about sharing information with the right people. The recent settlement between the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) and UnitedHealthcare Insurance Company (UHIC) serves as a compelling narrative for this. The Tale of a Delayed Share March 2021 saw a curveball thrown at UHIC when OCR flagged a concerning delay. An individual’s simple request for their medical records, made in January, wasn’t fulfilled until July. The tardiness wasn’t a first for UHIC – it was their third offense. UHIC’s oversight cost them $80,000, a commitment to make amends and a year under the OCR’s microscope. HIPAA makes it loud and clear: Patients have a fundamental right to timely access to their health information. Sharing Timely is Both Caring and Complying Melanie Fontes Rainer, the face of OCR, pointed out that delays aren’t just unkind – they’re unlawful regarding members’ health data. And the cost isn’t just monetary; reputations are at stake, too. Abyde’s Sharing Compass Navigating the maze of HIPAA compliance can be tricky, but Abyde’s HIPAA and OSHA Compliance Software offers a lifeline. Here’s what Abyde brings to the table:  Your Path to Smart Sharing UHIC’s story is a powerful reminder of the gravity of healthcare privacy laws. Instead of being the next UHIC, make “Sharing with the right people is caring – and the law” your motto. Let Abyde guide you in this endeavor. Kickstart your journey to guaranteed compliance. Set up a demo with Abyde now. Our mavens will craft a plan tailored to your organization, ensuring you comply and lead in this ever-evolving regulatory environment.

Pittsburgh HIPAA Violation
Fines, HIPAA

Healthcare Provider Pays $15,000 Due to HIPAA Violation

May 9, 2023 Comments Off on Healthcare Provider Pays $15,000 Due to HIPAA Violation

May 9, 2023 The United States Department of Health and Human Services, Office for Civil Rights (HHS), recently settled a case against the Office of David Mente, MA, LPC, for a violation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. The healthcare provider, who offers psychological care in Pittsburgh, Pennsylvania, has agreed to pay $15,000 and enter into a Corrective Action Plan (CAP). HHS received a complaint in December 2017 alleging that David Mente, MA, LPC refused to provide individual access to their minor children’s protected health information. After receiving technical assistance from HHS, a second complaint was filed in May 2018 concerning the continued noncompliance with the Privacy Rule. HHS investigated and found that David Mente, MA, LPC failed to provide timely access to protected health information since April 6, 2018. The parties agreed to resolve the matter without further investigation or formal proceedings. David Mente, MA, LPC, will pay a resolution amount of $15,000 and comply with a CAP to address the violation. The healthcare provider does not admit liability, nor does HHS concede that there is no violation of the HIPAA Rules. This situation could have been prevented with the help of the Abyde HIPAA Compliance Software Solution. The software offers a comprehensive and user-friendly solution to help healthcare providers maintain HIPAA compliance by assessing risk, implementing required policies and procedures, and providing ongoing support. By utilizing Abyde, healthcare providers can ensure that they are meeting the Privacy, Security, and Breach Notification Rules requirements and avoid costly settlements like the one faced by David Mente, MA, LPC.

January 2023 HIPAA Fine
Fines, HIPAA

With the first settlement announcement of 2023, OCR selects…

January 4, 2023 Comments Off on With the first settlement announcement of 2023, OCR selects…

January 4, 2023 We didn’t even make it through the first week of the new year before we saw the first settlement announcement. Yesterday, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services announced a settlement with a Georgia full-service diagnostic lab. The potential violation marks the 43rd associated with the HIPAA Right of Access Initiative to date. This is now the third Right of Access settlement we have seen in the last month.  The initial complaint was first filed back in August of 2021 when a personal representative was unable to obtain a copy of her deceased father’s medical records. While the lab finally complied in February of 2022, it took seven months for the requester to receive the records. The HIPAA right of access provision requires that patients be able to access their health information in a timely manner, typically within 30 days.  The lab has agreed to pay $16,500 and implement a corrective action plan to resolve this investigation. The corrective action plan includes two years of OCR monitoring. OCR Director, Melanie Fontes Rainer, shared her thoughts, “Access to medical records, including lab results, empowers patients to better manage their health, communicate with their treatment teams, and adhere to their treatment plans. The HIPAA Privacy Rule gives individuals and personal representatives a right to timely access their medical records from all covered entities, including laboratories.” While we all have the same goal in common – to provide the best experience for our customers and patients – that doesn’t always equate to direct care. Ensuring that their needs and requests are met is essential to the overall experience. From the first time they Google you all the way to a request for records, you are making an impression. And whether it’s the first impression or the last, don’t you want it to be a good one?

Fines, HIPAA

A costly race against the clock

December 16, 2022 Comments Off on A costly race against the clock

December 16, 2022 On Thursday, the HHS Office for Civil Rights announced a settlement with a Florida primary care practice over a violation of the HIPAA Privacy Rule’s right of access provision. This marks the 42nd case under the Right of Access Initiative to date and the second settlement this week.  All the way back in mid-2019, a daughter, serving as personal representative, was attempting to retrieve her deceased father’s records. After multiple attempts, the practice failed to provide timely access. HIPAA’s right of access standard requires a covered entity to take action on an access request within 30 days of receipt. The practice exceeded that allotted time; the daughter received all requested records nearly five months after the initial request.  OCR Director, Melanie Fontes Rainer, stated, “The right of patients to access their health information is one of the cornerstones of HIPAA, and one that OCR takes seriously.”  The FL primary care practice has since paid its $20,000 fine to the OCR and is working to implement a Corrective Action Plan. The plan will be closely monitored over the next two years and includes updating, distributing, and training on all applicable policies and procedures.  In the age of immediacy, there is no exception when it comes to patient record requests. When a patient requests access to their records, prioritize their request. You have 30 days to take action or you could face not only an OCR investigation but a big fine – one we bet is not worth rearranging your priorities to put the patient first.

Concerned about HIPAA & OSHA compliance requirements in 2025? Join our live webinar for expert answers to the most common questions to ensure your practice is protected.

REGISTER TODAY
X