On August 1, 2024, the U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights (“OCR”) announced a civil monetary penalty of $115,200 against American Medical Response (“AMR”) based on a complaint that AMR failed to provide a patient with timely access to their medical records.
What You Need to Know:
- Patients are entitled to timely access to copies of their medical records under HIPAA.
- OCR will enforce patient rights through the Right of Access initiative.
- HIPAA-covered entities should review their policies and procedures to confirm processes to ensure timely access for individuals to copies of their medical records.
This was the 49th – this is not a typo – Right of Access enforcement action imposed by OCR. The Right of Access initiative requires that individuals (or their personal representatives) be given timely access (within 30 days, with the opportunity for a 30-day extension) for a reasonable cost-based fee to their health information.
We have written previously about the OCR Right of Access Initiative, including here and here.
AMR provides emergency medical services across the United States.
In October 2018 an individual (through their attorney) sent a request via fax to AMR for a copy of the individual’s medical records relating to treatment provided in September 2015. In November 2018, the same request was sent via certified mail. In January 2019, two follow-up requests for the same information requested in October 2018 were sent via certified mail and via fax. AMR responded in March 2019 – 121 days following the initial request – by sending an invoice and requiring payment before the requested records would be provided. Later in March, the requestor again asked that the records be transmitted electronically or the requestor would file a complaint with OCR. At the end of July 2019, a complaint was filed to OCR. OCR notified AMR in October 2019 that it was investigating the complaint. AMR finally sent the records to the requestor in November 2019 – 370 days after the requestor’s initial request for records.
In October 2023, OCR issued a notice of proposed determination for the penalty it planned to impose against AMR based upon its investigation of this incident. Even though its analysis concluded this was a ‘neutral’ factor in assessing a penalty against AMR, the notice of proposed determination stated that OCR had received multiple right of access complaints against AMR.
Upon receiving the notice of proposed determination, AMR waived its right to a hearing and agreed to pay the $115,200 civil monetary penalty.
OCR has been aggressive in enforcing individuals’ rights pursuant to the right of access initiative. HIPAA-covered entities should confirm that their policies and procedures provide for timely access to medical records when requested by an individual and that there is an internal mechanism to ensure compliance. It is much easier and more cost effective to timely reply to a request for records from an individual than to engage with OCR for an extended period of time and potentially face an expensive civil monetary penalty.
