Today, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), announced a resolution with Phoenix Healthcare, a nursing care organization in Oklahoma with multiple facilities, regarding a potential violation under the Health Insurance Portability and Accountability Act (HIPAA) Right of Access provision. This settlement marks the 47th enforcement action in the OCR Right of Access Initiative. It mandates that individuals or their personal representatives must have timely access to their health information.
According to HIPAA regulations, covered entities must grant access to protected health information within 30 days of receiving a request from an individual. OCR’s investigation involved a daughter acting as a personal representative for her mother, who encountered difficulties accessing her mother’s protected health information despite making multiple requests. This agreement represents OCR’s 47th enforcement action related to the Right of Access provision.
Melanie Fontes Rainer, OCR Director, emphasized the importance of timely access to medical records for patients’ health and well-being. Delays or denials in releasing medical records can lead to incorrect treatments, inaccurate health records, and a lack of understanding of health conditions. Rainer called on healthcare providers to ensure compliance and empower patients by facilitating access to their medical records promptly.
In April 2019, OCR received a complaint alleging that Phoenix Healthcare failed to provide a daughter, acting as a personal representative, with her mother’s medical records. Despite attempts at technical assistance and interventions by OCR, Phoenix Healthcare only provided the requested records on January 30, 2020, 323 days after the initial request.
A copy of the Settlement Agreement can be found at https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/phoenix-healthcare/index.html