March OCR Settlements

March OCR Settlements

March 2021 is yet another month that represents the OCR’s continued dedication to enforcing HIPAA and specifically the Right of Access Initiative. As we can see in this settlement for the month, the OCR is still reaching final settlements for incidents that occurred, were investigated, and were resolved in the past few years. As this backlog of potential violations is cleared, it opens up space for the OCR to stay even further on top of currently occurring situations. We will go through all the details of the HIPAA settlements that were reached this month, the 17th and 18th under the Right of Access Initiative!

The Arbour Inc. 

 A Massachusetts behavioral health group, The Arbour Inc. doing business as Arbour Hospital (“Arbour”) has reached a settlement with the OCR regarding a potential HIPAA violation. Arbour will be expected to pay a $65,000 fine and institute a corrective action plan as a result of this Right of Access violation. 

Early in July 2019, the OCR received a complaint from an individual that Arbour had failed to complete a request for access to that person’s medical record back in May 2019. Since this situation exceeded the OCR’s requirement for covered entities to fulfill access requests within 30 days, the OCR stepped in to provide technical assistance regarding the HIPAA Right of Access requirements to Arbour at this time. Unfortunately, despite the technical assistance, the OCR received a second complaint from the original individual in late July 2019 stating that Arbour still had not completed the original request. 

At this point, the OCR launched an investigation into Arbour’s processing and handling of Right of Access requests and determined that there was a potential violation here. Following this investigation by the OCR, the individual was finally able to access their records in November 2019, over 5 months since they submitted their request. Arbour will pay this $65,000 fine, implement a corrective action plan, and submit to monitoring by the OCR for the next year. 

Village Plastic Surgery  

On March 26th, the Office of Civil Rights announced its eighteenth settlement under the Right of Access Initiative with Village Plastic Surgery (“VPS”) in New Jersey. VPS has agreed to pay a $30,000 fine in addition to implementing a corrective action plan as a result of this potential violation. 

This settlement originated from a complaint made by a patient of Village Plastic Surgery back in September 2019 after their request to access their own records was not completed within the required one-month window. The OCR quickly stepped in to investigate this situation and reached the conclusion that VPS’s inability to provide timely access to the patient’s PHI was a potential violation of HIPAA and the Right of Access Initiative. As a result of the settlement, VPS quickly delivered the requested records to that patient. 

Acting OCR Director Robinsue Frohboese was quoted as saying, “OCR’s Right of Access Initiative continues to support and enforce individuals’ vital right to receive copies of their medical records in a timely manner." The full details on the corrective plan and monitoring by the OCR on Village Plastic Surgery can be found here.