The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) charged a Californian mental health center a $100,000 civil monetary penalty for not providing prompt access to a patient’s healthcare records.
On March 18, 2020, a Rio Hondo Community Mental Health Center patient submitted a request for a copy of her medical records. The center, which is under the management of the Outpatient Program of the County of Los Angeles Department of Mental Health, should have provided the patient with a copy of the requested medical records in 30 days. However, the center failed to give the requested records until 7 months had passed.
The delay of two months was because California Governor Gavin Newsom gave a stay-at-home command on March 19, 2020, when the patient submitted the request. All County buildings were not open to the public and clinics had little to no personnel working during that time. Employees began to resume work in May 2020. On May 22, 2020, the patient received a phone call and was told to get her medical records on May 27, 2020.
The patient went to Rio Hondo on May 27 but was not given her records. She left her contact details with a request for notification when her records were available for pick up. The records were not available by July 17, 2020, and so the patient contacted Rio Hondo a number of times that day but the medical record department did not answer the calls.
In August 2020, the patient called Rio Hondo several times and was able to talk with a personnel, however, there was no medical records. On August 21, 2020, the patient submitted a complaint to OCR. OCR responded by reaching out to Rio Hondo concerning the complaint on October 7, 2020. Rio Hondo contacted the patient several times including sending an apology letter on October 19, 2020. The patient received the requested medical records the next day.
OCR looked into the incident and learned that Intermediate Typist Clerk (ITC) was responsible for providing the requested medical records. ITC was notified when the patient came to the clinic on May 27 yet postponed the meeting to check with several colleagues regarding the processing of the request. The ITC stated that it attempted one time to speak to the patient after the patient left the clinic. The ITC mentioned that the patient called on July 17, however, cannot remember whether they called back the patient.
OCR informed Rio Hondo regarding the results of the investigation on August 31, 2022. Without promptly providing a copy of the health records, Rio Hondo committed a violation of the HIPAA right of access. OCR gave Rio Hondo the chance to settle the issue informally, but Rio Hondo made no attempt to settle. On February 3, 2023, Rio Hondo was notified about the matter and was given the chance to send written proof of mitigating factors.
Rio Hondo replied and said it could not process the records in the first 60 days because of the stay-at-home order. After that time, it attempted to contact the patient several times but the patient didn’t answer. Rio Hondo likewise said that protocols were altered to make sure that identical circumstances were avoided later on. OCR decided that the submitted proof didn’t support a civil monetary penalty waiver, and charged a $100,000 penalty for the 156 days that Rio Hondo did not give the medical records from May 17, 2020, to October 20, 2020. The computed penalty was $215,124 with a cap of $100,000 according to OCR’s 2019 notice of enforcement discretion.
OCR Director Melanie Fontes Rainer said that patients shouldn’t have to request their health records repeatedly before getting access to them. Protecting patients’ rights to prompt access to medical data is still a HIPAA enforcement priority. It is the legal responsibility of healthcare providers to give patients prompt access to their medical records. Whenever they fail to give that access, OCR will do everything, including enforcing civil monetary penalties, to ensure HIPAA compliance.
This was OCR’s 51st HIPAA violation penalty issued to settle an alleged HIPAA Right of Access violation, and the 12th financial penalty of 2024 to settle HIPAA noncompliance.