Electronic Healthcare Records , Governance & Risk Management , HIPAA/HITECH

HHS OCR Issues Another 'Right of Access' Settlement

Federal regulators Thursday issued their 11th HIPAA settlement – the ninth in recent months - involving a patient right of access to records case. The resolution agreement with a Queens, New York, physician’s practice calls for a $15,000 penalty and adoption of a corrective action plan.

See Also: OnDemand | Making the Connection Between Cybersecurity and Patient Care

In a statement, the Department of Health and Human Services’ Office for Civil Rights says that in September 2018, it received a complaint alleging that Rajendra Bhayani, M.D., an ear, nose and throat specialist, failed to provide a patient with access to her medical records following her request in July 2018.

”OCR responded by providing Dr. Bhayani with technical assistance on complying with HIPAA’s Right of Access requirements and closed the complaint. In July 2019, however, OCR received a second complaint alleging that Dr. Bhayani still had not provided the complainant with access to her records,” the statement says.

As a result of OCR’s investigation into the matter, the patient eventually received a complete copy of her medical records in September.

“Doctor’s offices, large and small, must provide patients their medical records in a timely fashion,” said Roger Severino, OCR director in the HHS statement. ”We will continue to prioritize HIPAA right of access cases for enforcement until providers get the message.

Corrective Actions

Under the resolution agreement with Bhayani, his practice will undertake a corrective action plan that includes:

• Reviewing and revising policies and procedures for individual access to protected health information;
• Providing privacy training on individual access to PHI to his workforce;
• Submitting to HHS for two years a list of requests for access to PHI received by the practice, including the date the requests were received and the date the records were provided.

Bhayani’s practice did not immediately respond to an Information Security Media Group request for comment on the settlement.

Other Settlements

Last week, HHS OCR announced a $25,000 settlement in a patient right of access case involving Riverside Psychiatric Medical Group, a group practice in Riverside, California, specializing in child and adolescent mental healthcare.

The agreement with Bhayani, is the 16th HIPAA settlement of any type announced by OCR so far this year. Those HIPAA settlements included a total of more than $13.4 million in penalties.

The largest of OCR's HIPAA enforcement actions so far this year was a $6.8 million settlement announced in September with Premera Blue Cross in a case involving a 2014 breach that exposed information on 10.4 million individuals.