Last month the U.S. Department of Health and Human Services (HHS) announced Health Specialists of Central Florida agreed to pay a settlement of $20,000 to resolve potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule’s right of access provision. The rule requires that patients be able to access their health information in a timely manner.
This post will cover what happened, how Health Specialists of Central Florida is going resolve the HIPAA violation, and what the right of access provision is.
See also: HIPAA Compliant Email: The Definitive Guide
What happened
Health Specialists of Central Florida is a primary care provider in Orlando. In August 2019, a daughter acting as a personal representative requested medical records on behalf of her deceased father. Despite multiple requests, it took nearly five months to receive the information.
A complaint was filed with the HHS Office of Civil Rights (OCR) and a follow up investigation concluded Health Specialists of Central Florida failed to provide timely access to the requested medical records.
Resolving the HIPAA violation
Health Specialists of Central Florida agreed to implement a corrective action plan and pay $20,000 to resolve the investigation.
See also: HIPAA violation settlement for Life Hope Labs
HIPAA Right of Access Initiative
Launched in 2019, the OCR HIPAA Right of Access Initiative is designed to, “to support individuals’ right to timely access their health records at a reasonable cost under the HIPAA Privacy Rule.” This investigation marked the 42nd case to be settled under the initiative.
The right of access provision states that a covered entity must provide access to protected health information (PHI) no later than 30 days from receiving the request.
According to OCR Director Melanie Fontes Rainer:
“The right of patients to access their health information is one of the cornerstones of HIPAA, and one that OCR takes seriously. We will continue to ensure that health care providers and health plans take this right seriously and follow the law. Today’s announcement speaks to the importance of accessing information and regulated entities taking steps to implement procedures and workforce training to ensure that they are doing all they can to help patients access.”
