The HHS’ Office for Civil Rights has reached a settlement with The Diabetes, Endocrinology & Lipidology Center, Inc. (DELC) to resolve a potential violation of the HIPAA Right of Access. This is OCR’s 8th financial penalty to be issued in 2021 for resolving HIPAA Rules violations. It is also the 19th settlement associated with OCR’s HIPAA Right of Access enforcement initiative, which began in late 2019.
DELC, which is based in West Virginia-based, is a healthcare provider with a specialty in the treatment of endocrine diseases. Last August 2019, OCR got a complaint about the alleged failure of DELC to take action on a request for a copy of protected health information (PHI) promptly. The HIPAA Privacy Rule mandates healthcare organizations to provide a copy of a person’s PHI contained in a specified record set within 30 days of receiving a request.
In this instance, the complainant requested a copy of her minor child’s PHI and DELC was unable to deliver those records in the required 30 days. OCR informed DELC on October 30, 2019 regarding the investigation of the probable noncompliance with the HIPAA Right of Access (45 C.F.R. § 164.524) associated with the supposed refusal to deliver the records requested by the patient’s mother.
OCR established that the inability to deliver the requested documents violated the HIPAA Right of Access. Based on OCR’s investigation, DELC eventually delivered a copy of the records requested by the child’s mother in May 2021, more or less two years after receiving the initial request.
Besides the financial charges of $5,000, DELC has consented to implement a corrective action plan that consists of evaluating and updating guidelines and procedures for giving access to individuals’ PHI and providing its workforce with privacy training on individual access to PHI. OCR will be monitoring DELC for 2 years to make sure of compliance with the Right of Access conditions of the HIPAA Privacy Law.
A HIPAA-covered entity should not wait for a federal investigation to be undertaken before giving a parent access to their child’s healthcare records, stated Acting OCR Director Robinsue Frohboese. It is the covered entities’ obligation to provide their patients with prompt access to healthcare records.