November OCR Settlement Round-up

November was yet another month packed full of right of access settlements between HIPAA covered entities and the Office of Civil Rights (OCR) within Health and Human Services (HHS). Although there was a lull in HIPAA settlements during the early part of 2020, the settlements, especially under the Right of Access Initiative, have been consistent throughout the past few months. This month we saw three OCR settlements, all of which stemmed from a potential violation of an individual’s right to have access to their medical records quickly and affordably upon their request. 

This month the settlements include a private practitioner, an academic medical center and a psychiatric medical group. Here is a quick summary of each of the investigations and OCR settlements that took place throughout November 2020: 

Tic Tac Toe… Three More Right of Access Settlements in a Row! 

Riverside Psychiatric Medical Group 

A Riverside, California based practice group specializing in childhood and adolescent psychiatry, Riverside Psychiatric Medical Group (RPMG) was the tenth organization to reach an OCR settlement under the right of access initiative. This $25,000 settlement follows a March 2019 complaint from a patient who had requested her records but had not received them within 30 days of her initial request. At this point the OCR provided the Riverside Psychiatric Medical Group with technical assistance regarding the right of access initiative in order to help them comply moving forward. At this point the OCR closed this complaint situation. 

Unfortunately, the OCR received a second complaint from the same individual in April 2019, following the original complaint being closed and the requested record still not having been delivered. As a result of this second complaint and the ensuing OCR investigation and settlement, the patient received her requested medical record in October 2020, just about 18 months after her initial request. Riverside Psychiatric Medical Group will be required to follow this resolution, implement a corrective plan and be monitored for the next two years. 

Dr. Rajendra Bhayani 

A private otolaryngology practitioner, Dr. Rajendra Bhayani, who practices in Regal Park, NY was responsible for the eleventh settlement under the Right of Access Initiative. This $15,000 fine comes after a September 2018 complaint from a patient who had yet to receive their record following a request in July 2018. Just as we saw above, the OCR responded to this complaint, provided Dr. Bhayani with technical assistance to help the practice comply with the right of access initiative. 
However, despite this technical assistance, the same patient submitted another complaint in July 2019 that they had still not received the records initially requested a full year beforehand. The OCR determined that this situation resulted in a potential violation of HIPAA requirements. As a result of this investigation and settlement, the patient finally received their requested records in September 2020. Dr. Bhayani will be required to pay the fine, follow the corrective plan and submit to two years of monitoring. 

In light of this settlement, Roger Severino, the OCR Director, was quoted as saying that “Doctor’s offices, large and small, must provide patients with their medical records in a timely fashion. We will continue to prioritize HIPAA Right of Access cases for enforcement until providers get the message.”

The University of Cincinnati Medical Center, LLC

The third and final HIPAA settlement for the month of November was with The University of Cincinnati Medical Center, LLC (UCMC). A patient submitted a complaint to the OCR in May 2019 following a February 2019 complaint that her request for her EHR records to be sent directly to her lawyer was not fulfilled. The OCR investigated this situation and found that UCMC was responsible for a potential violation to the right of access requirement. 

This request was fulfilled following the investigation and the records were successfully delivered to the patient’s lawyers. This academic medical center will be required to pay a $65,000 fine, follow a corrective plan and allow two years of OCR monitoring  as a result of this investigation. The OCR Director has used this situation to emphasize that under the right of access initiative, not only do the patients have the right to their own information, but they also have the right to have electronic copies of their records sent directly to a third party of their choice in a timely and affordable manner.