Arizona health care provider settles HIPAA Right of Access violation

The Office for Civil Rights at the U.S. Department of Health and Human Services announced Oct. 7 it settled a case involving an Arizona health care provider’s potential violation of the Health Insurance Portability and Accountability Act Right of Access Initiative.
Dignity Health, which operates at St. Joseph’s Hospital and Medical Center in Phoenix, Arizona, has agreed to take corrective actions and pay $160,000 to settle the potential violation, according to HHS.
The HIPAA Right of Access Initiative, created in 2019, supports individuals’ right to timely access to their health records at a reasonable cost under the HIPAA Privacy Rule.
The settlement — OCR has announced a total of nine enforcement actions under the HIPAA Right of Access Initiatives so far this year — stems from an April 25, 2018 complaint the Office for Civil Rights received from a mother said she sought a copy of her son’s medical records as his personal representative.
The mother alleged that beginning in January 2018, she made multiple requests to the medical center, according to the HHS news release. However, despite follow-up requests in March, April and May 2018, the medical center did not provide all of the requested records.
The Office for Civil Rights’ investigation determined that the medical center’s actions were a potential violation of the HIPAA Privacy Rule right of access requirement. More than 22 months after her initial request, according to HHS, the mother received the requested medical records on Dec. 19, 2019.
“It shouldn’t take a federal investigation to secure access to patient medical records, but too often that’s what it takes when health care providers don’t take their HIPAA obligations seriously,” said OCR Director Roger Severino in a news release. “OCR has many right of access investigations open across the country, and will continue to vigorously enforce this right to better empower patients.”
As part of the settlement, St. Joseph’s Hospital and Medical Center agreed to undertake a corrective action plan that includes two years of monitoring.