This agreement signifies the 46th enforcement action in the OCR Right of Access Initiative.
On December 15, The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), recently settled with Optum Medical Care of New Jersey (formerly Riverside Medical Group and Riverside Pediatric Group). This medical group, serving patients in New Jersey and Southern Connecticut, faced multiple complaints alleging potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule’s Right of Access provision. According to the settlement, Optum failed to provide individuals or their representatives timely access to their health information as required by the HIPAA Right of Access provision, which mandates access within 30 calendar days. As a resolution, Optum has agreed to implement a corrective action plan to ensure patients’ timely access to their records. Additionally, they will pay $160,000 to settle the matter. This marks the 46th enforcement action by OCR about the Right of Access provision.
OCR Director Melanie Fontes Rainer emphasized the importance of healthcare providers prioritizing timely responses to requests from parents or patients for access to medical records. According to her, access to medical records is a fundamental right protected by HIPAA, and OCR receives numerous complaints annually regarding this matter. Rainer stated that providers are obligated by law to actively and promptly address record requests, as access to medical records plays a crucial role in empowering patients and their families to make informed decisions about their healthcare and ultimately enhance their overall well-being. Providers must adhere to the legal requirements in this regard.
In the autumn of 2021, OCR received six complaints accusing Optum Medical Care of neglecting to furnish copies of medical records as requested by an adult patient or the parents of minor patients. By February 2022, OCR had launched investigations into these Right of Access complaints. The complaints revealed that patients only received their requested records between 84 and 231 days after submitting their requests. These timeframes significantly exceeded the HIPAA Right of Access requirement, which stipulates that providers must grant access to medical records within 30 calendar days of receiving the individual’s request. OCR’s investigation concluded that Optum Medical Care’s failure to provide timely access to the requested medical records could violate HIPAA.
Optum Medical Care must pay $160,000 to OCR and follow a corrective action plan. This plan includes training staff, reporting record requests to OCR, and updating their policies for timely responses. OCR will monitor Optum Medical Care for a year to ensure they stick to the plan.
Consider buying pre-written HIPAA Privacy and Security Policies and Procedures if you are starting to work on you HIPAA compliance documents.