The HHS’ Office for Civil Rights (OCR) made an announcement of its first HIPAA enforcement action for 2023. The OCR is reminding HIPAA-covered entities of their responsibility to provide people and their personal representatives with prompt access to their health documents. Life Hope Labs, LLC, has agreed to pay the $16,500 penalty to resolve the case.
HIPAA Right of Access Failures
Under the HIPAA Right of Access, covered entities need to give a copy of a person’s protected health information (PHI) that is retained in a specific record set within 30 days of having received that request. In a number of cases, it is allowed to delay as many as 30 days, so long as the patient is advised regarding the rationale for the delay and at the same time notified when the request will be met.
OCR had been actively carrying out its HIPAA compliance initiative since 2019 targeting organizations that fail to provide people and their personal representatives with a copy of their requested medical records in a timely manner, and those that were asking for unfair fees in exchange for those records. Including the newest settlement, OCR has already enforced financial penalties on 43 healthcare providers for probable violations of HIPAA Right of Access.
Life Hope Labs Enforcement Action
Life Hope Labs based in Sandy Springs, GA provides diagnostic laboratory services. On August 24, 2021, the personal representative of a patient’s estate submitted a complaint with the OCR. The complainant asserted that it filed a request for a copy of the health documents of the decedent with Life Hope Labs on July 7, 2021, nevertheless, the provider did not give the records. It took Life Hope Labs 7 months from the first request to deliver those documents. The complainant, who is the daughter of the deceased, acquired the complete set of records on February 16, 2022. OCR affirmed that the delay in giving the requested documents violated the HIPAA Right of Access, as written in 45 C.F.R. § 164.524.
Life Hope Labs consented to pay OCR the $16,500 penalty to resolve its case of HIPAA Right of Access violation, without admitting any wrongdoing. Based on the terms of the settlement, Life Hope Labs must follow a corrective action plan that involves the necessity to develop, maintain, and change, as needed, written policies relating to the HIPAA Privacy Rule, such as the right of patients to gain access to and get a copy of their PHI and to deliver those guidelines to all staff members. HIPAA training on those policies must likewise be given to all new employees within 30 days of beginning the job. The settlement additionally includes 2 years of monitoring.
Access to medical records, including lab results, enables patients to better handle their health, talk with their treatment teams, and stick to their treatment plans. The HIPAA Privacy Rule offers individuals and personal representatives a right to timely access to their health documents from all regulated entities, for instance, laboratories. HIPAA-covered laboratories need to adhere to the law and be sure that they are responding timely to requests for medical records access.
