Florida health system South Broward Hospital District, also known as Memorial Healthcare System, has consented to resolve an alleged HIPAA Right of Access violation determined by the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR).
The HIPAA Privacy Rule provides people rights concerning their medical records, which include the right to acquire a copy of the data and to only pay a fair cost-based amount. When a request is received, a HIPAA-covered entity must provide the records in 30 days, or in restricted conditions, there may be a 30-day extension. OCR got a patient’s complaint on June 23, 2021, who claimed he had filed a request on April 26, 2021, for a copy of certain medical records, but Memorial Healthcare System failed to provide those records.
OCR looked into the incident and learned that the patient sent a written request for the information on April 26, 2021, but it wasn’t the first time he filed a request. On December 30, 2020, the patient requested a copy of an EEG tracing using the Memorial Healthcare System patient portal. On April 25, 2021, the patient again submitted a request for the records through the patient portal. Then on May 23, 2021, the patient followed up on his request to get his EEG tracing.
Memorial Health System gave the patient a copy of the records only after OCR had opened up an investigation. The patient got the requested information on September 29, 2021, after 9 months of filing the initial request. OCR found out that Memorial Healthcare System had once given the EEG tracing to the patient; but for the December 30, 2020 request and the succeeding requests, he did not give a copy of the data.
OCR recommended a $100,000 civil monetary penalty to settle the alleged HIPAA Right of Access violation. Memorial Health System questioned the investigation findings and asked for a hearing in the court of an Administrative Law Judge. Although the case is due to be heard in the Civil Remedies Division of the Departmental Appeals Board, a settlement of the alleged violation has been reached between OCR and Memorial Healthcare System. As per the settlement conditions, Memorial Health System will pay a $60,000 financial penalty to end the awaiting litigation.
Image credits: logo©MemorialHealthcareSystem / image: ontsunan, AdobeStock
