Essex Residential Care, LLC, must pay $100,000 as a result of failing to adhere to HIPAA’s Right of Access.

The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), has declared a civil monetary penalty of $100,000 against Essex Residential Care, LLC, operating as Hackensack Meridian Health, West Caldwell Care Center (“Hackensack Meridian Health”), a skilled nursing facility offering long-term care and rehabilitation services. The penalty stems from an investigation by OCR into Hackensack Meridian Health’s violation of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule, specifically for failing to promptly provide a patient’s personal representative with access to the patient’s medical records.

The HIPAA Privacy Rule is a federal law that sets national standards for safeguarding individuals’ medical records, imposes restrictions and conditions on the use and disclosure of protected health information, and grants individuals specific rights, including the right to timely access and obtain copies of their health records. Today’s action addresses a situation where patient records were not provided promptly.

Melanie Fontes Rainer, Director of OCR, emphasized, “A patient’s timely access to health records is crucial for medical care. The Office for Civil Rights consistently receives complaints from individuals and personal representatives regarding delays in accessing health records. OCR will vigorously enforce this fundamental right to ensure compliance by healthcare facilities nationwide.”

In May 2020, OCR received a complaint alleging that Hackensack Meridian Health failed to grant a personal representative access to his mother’s medical records. Despite adequate documentation proving that the son was acting as his mother’s personal representative, the records were allegedly withheld by Hackensack Meridian Health. Following OCR’s investigation, the requested records were finally provided to the personal representative in November 2020.

OCR determined that Hackensack Meridian Health did not respond promptly to a HIPAA right of access request. In September 2023, OCR issued a Notice of Proposed Determination, proposing a civil monetary penalty. Hackensack Meridian Health opted not to contest OCR’s findings and waived its right to a hearing. Consequently, OCR imposed a civil monetary penalty of $100,000.

The Notice of Proposed Determination can be accessed at https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/hackensack-meridian-health-west-caldwell-care-center/index.html#npd