Optum Medical Care of New Jersey, P.C. (formerly Riverside Medical Group), a multi-specialty physician group, recently settled multiple complaints with the U.S. Department of Health and Human Services' Office for Civil Rights (OCR).
The OCR investigated six complaints against Optum Medical Care, filed in Fall 2021, which were raised by both adults and parents of minors. These complaints accused Optum Medical Care of not providing timely access to medical records, a violation of the HIPAA Privacy Rule's Right of Access provision. The OCR's investigation confirmed these allegations, revealing that they delayed providing patients with their records for 84 to 231 days, far exceeding the legally required 30-day limit. To resolve these violations, Optum Medical Care agreed to pay $160,000 and implement a comprehensive Corrective Action Plan.
See also: OCR settles landmark phishing case that affected 35,000 patients
The settlement is part of OCR's ongoing Right of Access Initiative, marking its 46th enforcement action. It underscores the legal requirement for healthcare providers to offer timely access to medical records, a critical aspect of patient care and empowerment. The $160,000 penalty and the mandated Corrective Action Plan address the specific violations by Optum Medical Care and send a strong message to the healthcare industry about the necessity of upholding patient rights.
OCR Director Melanie Fontes Rainer said “Access to medical records is a fundamental right under HIPAA, and one for which OCR receives thousands of complaints each year. This is the law—providers must proactively respond to record requests and ensure timely access. Access to medical records empowers patients and their families to make decisions about their health care and improve their health overall. It is critical that providers follow the law.”
See also: What are HIPAA Right of Access provisions?
Optum Medical Care of New Jersey, P.C. is now required to undertake specific actions to rectify its compliance issues with HIPAA's Right of Access provision. This plan involves reviewing and revising their policies and procedures for patient access to health records, conducting comprehensive training for their workforce on these revised policies, and regularly reporting their progress to OCR. The OCR will closely monitor Optum's compliance for a year, ensuring adherence to the agreed-upon terms.
See also: HIPAA Compliant Email: The Definitive Guide