The U.S. Department of Health and Human Services (HHS) has settled with healthcare provider Concentra, Inc. for failing to provide a patient with timely access to their own medical records.
An investigation found that after a patient made six requests starting in February 2018, Concentra did not provide the records until March 2019—over a year later. HIPAA law requires providers to fulfill such requests within 30 days.
Concentra has agreed to pay $112,500 to resolve the case. This marks the 54th enforcement action under HHS’s “Right of Access” initiative, which emphasizes that patients have a fundamental right to access their health information promptly.
“Individuals should not have to file multiple requests or a federal complaint to get their own medical records,” said OCR Director Paula M. Stannard.
The Notice of Proposed Determination may be found at: https://www.hhs.gov/sites/default/files/ocr-concentra-npd.pdf
The Settlement Agreement may be found at: https://www.hhs.gov/sites/default/files/ocr-concentra-settlement-agreement.pdf
OCR is committed to enforcing the HIPAA Rules that protect the privacy and security of people’s health information. Guidance about the Privacy Rule, Security Rule, and Breach Notification Rule can be found on OCR’s website. OCR guidance on the HIPAA Right of Access provisions, including guidance on parental access to minor children’s protected health information, can also be found on OCR’s website. These guidance documents explain the Right of Access provision under the HIPAA Privacy Rule, which requires that individuals or their personal representatives (which generally include the parents or guardians of minor children), be given access to the PHI in designated record sets.