The HHS Office for Civil Rights resolves a HIPAA case with Memorial Healthcare System regarding patient access to medical records.

The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), has announced a settlement with Memorial Healthcare System, also known as South Broward Hospital District, a Florida-based health system, for a potential violation of the HIPAA Privacy Rule. The case stems from a complaint alleging that Memorial Healthcare System failed to provide timely access to an individual’s protected health information (PHI), as required by the HIPAA Right of Access provisions. These provisions mandate that individuals or their representatives must receive access to their health records promptly and at a reasonable cost.

OCR’s investigation concluded that Memorial Healthcare System did not provide the requested records within the required 30-calendar-day timeframe. As a result, Memorial Healthcare System has agreed to pay $60,000 to resolve the matter. This settlement represents OCR’s 52nd enforcement action under the Right of Access Initiative.

“A patient’s right to timely access their own health information is a fundamental element of the HIPAA Privacy Rule,” stated OCR Director Melanie Fontes Rainer. “Healthcare organizations must prioritize responding to patients’ requests for their medical records. Patients should not need to file complaints with OCR to access their health information.”

The investigation began after an individual filed a complaint claiming that repeated requests for medical records—submitted via mail, phone, and the hospital’s patient portal starting on December 30, 2020—were ignored. The patient finally received access to the requested records about nine months later, only after OCR intervened. The investigation confirmed that Memorial Healthcare System failed to act in a timely manner, as required under HIPAA.

In July 2024, OCR issued a Notice of Proposed Determination, intending to impose a civil monetary penalty. Memorial Healthcare System responded by requesting a hearing before an Administrative Law Judge. On December 13, 2024, the healthcare system agreed to a settlement, which included a $60,000 payment, to resolve the pending administrative litigation.