Today, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced the imposition of a civil monetary penalty of $115,200 on American Medical Response (AMR), a provider of emergency medical services nationwide. This penalty resulted from an investigation triggered by a complaint that AMR had failed to provide a patient with timely access to their medical records. Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule, individuals or their personal representatives are entitled to timely access to their health information within 30 days, with a potential extension of another 30 days, for a reasonable, cost-based fee.
“HIPAA grants patients the right to timely access to their medical records,” stated OCR Director Melanie Fontes Rainer. “OCR will continue to uphold this right through investigations and, when necessary, by imposing civil monetary penalties.”
OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules, which outline the obligations of covered entities (health plans, health care clearinghouses, and most health care providers) and business associates regarding the privacy and security of protected health information. The HIPAA Privacy Rule establishes national standards to safeguard individuals’ medical records, regulates the use and disclosure of protected health information, and grants individuals certain rights, including the right to timely access and obtain a copy of their health records.
OCR received a complaint alleging that AMR failed to provide a patient with timely access to their medical records despite multiple attempts by the patient. OCR’s investigation confirmed that AMR did not provide the patient with timely access to their records. Following the investigation, AMR sent the patient a copy of the requested records and revised its internal procedures to better track and streamline right-of-access requests in compliance with the law. In October 2023, OCR issued a Notice of Proposed Determination to impose a civil monetary penalty. AMR waived its right to a hearing and did not contest OCR’s findings. Consequently, OCR finalized its determination and imposed the penalty on AMR.
Read the Notice of Proposed Determination and Notice of Final Determination.