February OCR Settlements

February continues yet another month of the OCR sticking to their recent settlement theme - the right of access initiative. Even with the OCR going through some leadership changes right now, they have remained dedicated to their mission as stated. Individuals deserve the right to have accurate and timely access to their own health records and information upon request. 

In the second month of the year, the OCR reached 2 settlements with organizations over potential violations of HIPAA, both under the Right of Access Initiative. These two settlements represent the 15th and 16th underneath this initiative, dating back to mid-2019. 

Renown Health P.C. 

A not-for-profit Nevada health system, Renown Health P.C., has reached a settlement with the OCR and will pay $75,000 due to a potential violation of the HIPAA Right of Access Initiative. 

In February 2019, the OCR received a complaint from an individual that Renown had not fulfilled her request for her medical and billing records to be sent to a third party of her choosing. Upon investigation, the OCR found that this situation was a potential violation of the HIPAA right of access initiative. As a result of this incident, Renown Health has fulfilled this individual’s request and provided access to all of the requested access. 

In addition to paying the $75,000 settlement, Renown Health will also undergo a complete corrective action plan, including 2 years of OCR monitoring. 

Sharp HealthCare, as Sharp Rees-Stealy Medical Centers (SRMC) 

The second settlement that was reached this month was between the OCR and Sharp Health doing business as Sharp Rees-Stealy Medical Centers which is located in California. 

This settlement with Sharp Healthcare follows an investigation that stemmed from an initial complaint that was filed in June 2019. The patient alleged that SRMC had failed to respond to their request to have their ePHI in the form of a health record sent to a third party. The OCR became involved at this time and provided Sharp Healthcare with technical assistance on the requirements of the right of access initiative. 

Unfortunately, following that assistance, the OCR did receive a second request from the same individual in August 2019 that their health record had still not been sent to the third party. After the second complaint, the OCR determined that this situation was a potential violation of HIPAA, 

Sharp Healthcare will be required to follow a 2-year monitoring and corrective action plan process moving forward.