The US Department of Health and Human Services (HHS), Office for Civil Rights (OCR), announced a civil monetary penalty against Essex Residential Care, LLC, doing business as Hackensack Meridian Health, West Caldwell Care Center. The nursing facility in New Jersey has been penalized for failing to provide timely access to patient records, thereby violating the HIPAA privacy rule.
Hackensack Meridian Health, the nursing facility under investigation, was found to have failed to provide a patient's personal representative with timely access to the patient's medical records. The investigation was initiated following a complaint received by OCR in May 2020. The complaint alleged that Hackensack Meridian Health withheld the patient's medical records even after receiving sufficient documentation demonstrating that the complainant was serving as the patient's personal representative.
After a thorough investigation, OCR found that Hackensack Meridian Health did not respond promptly to a HIPAA right of access request. As a result, OCR issued a Notice of Proposed Determination in September 2023, seeking to impose a civil money penalty on the nursing facility. Hackensack Meridian Health waived its right to a hearing and did not contest OCR's findings. Consequently, OCR imposed a civil monetary penalty of $100,000 on the facility.
OCR Director Melanie Fontes Rainer stated, "A patient’s timely access to health records is paramount for medical care. The Office for Civil Rights continues to receive complaints from individuals and personal representatives on behalf of individuals who do not receive timely access to their health records. OCR will continue to vigorously enforce this right to ensure compliance by healthcare facilities across the country.”
The failure to provide timely access to records can have significant implications for patients seeking medical care or managing health conditions. Patients require access to their medical records to make informed healthcare decisions and receive appropriate medical treatment. By imposing this civil monetary penalty, OCR makes it clear that complying with the HIPAA privacy rule and protecting patients' rights is mandatory. To rectify the situation, Hackensack Meridian Health sent the requested records to the personal representative in November 2020, following OCR's investigation.