HIPAA Right of Access Initiative: 2020 Year in Review

Friday, December 11, 2020

In 2020, the Workplace for Civil Rights (OCR) stored the promise it made the prior 12 months to “vigorously implement” the rights of sufferers to entry and train management over their medical data. OCR has settled ten “proper of entry” investigations since September 2020 alone. The settlements prolonged throughout a variety of coated entities, from massive well being care techniques to smaller centered psychological well being service suppliers, and the settlement quantities diversified extensively, starting from $3,500 to $160,000.

Along with the financial settlements, all of the coated entities concerned are topic to detailed corrective motion plans (CAPs), which embody one to 2 years of monitoring by OCR. Importantly, the entire investigations that resulted in settlements so far had been initiated after the person making an attempt to entry the data filed a grievance with OCR. In a number of instances, the person made a number of complaints to OCR over time after the person was unable to entry the requested data.

An in depth abstract of every settlement seems of the underside of this put up, however a key takeaway is that coated entities should reply to a person’s entry request no later than 30 days after receipt of the request. The entire settlements so far concerned, at the very least partly, a failure to reply inside that required timeframe.

Word that OCR launched proposed guidelines yesterday that, if finalized, would implicate lots of the proper of entry provisions under.

Abstract of HIPAA’s Entry Proper

HIPAA supplies that coated entities should allow people to examine and procure a duplicate of their protected well being data (PHI) maintained in a delegated file set, with very restricted exceptions. 45 CFR § 164.524. OCR has issued extra steering on the entry proper, making clear the proper may be very broad. Contemplating OCR’s current curiosity in enforcement on this area, coated entities ought to guarantee their insurance policies, procedures, and practices help people’ entry rights in accordance with HIPAA’s necessities, together with the next areas. Word that to the extent state legislation supplies people with larger entry rights than HIPAA, coated entities should comply with the state legislation along with HIPAA.

Timeframe for Responding. Lined entities should act on the request no later than 30 days after receipt by (i) offering the entry requested, (ii) denying the request if permitted by HIPAA, or (iii) notifying the person that an extension is required in accordance with HIPAA’s necessities. OCR states in its entry steering that “30 calendar days is an outer restrict and coated entities are inspired to reply as quickly as attainable.” OCR additional states that coated entities might be able to present people with “nearly instantaneous or very immediate digital entry to the PHI requested by means of private well being data, internet portals, or related digital means” and that “people might moderately anticipate a coated entity to have the ability to reply in a a lot quicker timeframe when the coated entity is utilizing well being data expertise in its each day operations.”

Designated File Set Scope. People have the proper to entry PHI maintained in a “designated file set.” The definition of “designated file set” is broad. It consists of medical data and billings data maintained by or for a supplier, enrollment and fee data maintained by or for a well being plan, or another data used to make choices about people, no matter whether or not these data have truly been used to make choices concerning the specific particular person requesting entry. 45 C.F.R. § 164.501. Lined entities ought to clearly outline within the coated entity’s insurance policies and procedures the data that’s included within the “designated file set.”

Type and Format Requested. Lined entities should present entry to PHI within the kind and format requested by the person, if readily producible in that kind and format. If the PHI is just not readily producible within the request kind and format, the coated entity and particular person might want to mutually agree on one other kind and format. If a person requests a type of digital copy that the coated entity is unable to provide, the coated entity should supply different digital codecs which are out there on its techniques. The coated entity can solely present a tough copy of the PHI to satisfy the request if the person declines all of the digital codecs supplied by the coated entity. Word that OCR has said that “mail and e-mail are thought of readily producible by all coated entities.”

Charges. HIPAA has very particular limitations on the charges that may be charged to people accessing their very own PHI. People can solely be charged for the price of:

Labor for copying the requested PHI (whether or not in paper or digital kind). This does not embody any labor to establish, retrieve, gather, compile, or collate the requested PHI;
Provides for making a paper copy or responsive digital media (e.g., CD-ROM or USB) if the person requests entry through moveable media;
Postage for paper copies that people request be mailed; and
Preparation of an evidence or abstract of the responsive PHI, provided that such abstract and value is agreed to by the requesting particular person prematurely.

Different prices can’t be charged, even when permitted by state legislation. Word these payment limitations don’t apply to a person’s request for a coated entity to transmit data on to a 3rd social gathering.

Written Request. Lined entities can management how people make entry requests. For instance, coated entities might require that people make entry requests in writing, supplied people are knowledgeable of any such necessities. Lined entities may require people to make requests within the coated entities equipped kind and/or supply people the chance to make requests by means of digital means (e.g., through e-mail or safe internet portal). Nonetheless, coated entities might not implement request necessities that create a barrier to particular person’s exercising their entry rights or unreasonably delay entry to their PHI.

Word that coated entities shouldn’t require people to finish a full HIPAA authorization to train their entry rights underneath HIPAA. As a result of a HIPAA authorization requests extra data than is important, or which can be related, for people to train their entry rights, OCR states that requiring execution of a HIPAA authorization might create impermissible obstacles to the train of this proper.

Proper to Direct Copies to a Third Get together. HIPAA’s entry rights present people with the proper to direct a coated entity to transmit their digital PHI on to a 3rd social gathering designated by the requesting particular person. This request should be in writing, be signed by the requesting particular person, and clearly establish the designated third social gathering and the the place to ship the PHI.

Within the phrases of OCR Director Roger Severino, “It shouldn’t take a federal investigation to safe entry to affected person medical data, however too usually that’s what it takes when well being care suppliers don’t take their HIPAA obligations critically. OCR has many proper of entry investigations open throughout the nation, and can proceed to vigorously implement this proper to raised empower sufferers.”

#
Settlement Date
Alleged Violation(s)
Abstract of Info
Settlement
1
Sept 2019
– Well timed Entry
– Failed to supply a mom well timed entry to data about her unborn little one.
– Data had been supplied > 9 months after initially requested.
– Entry proper “extends to folks who search medical details about their minor kids, and on this case, a mom who sought prenatal well being data about her little one.”
$85,000 + CAP w/ 1 12 months of monitoring
2
Dec 2019

– Well timed Entry
– Transmission to Third Get together
– Type/Format
– Charges

– Failed, regardless of repeated requests, to well timed present a affected person’s medical data to a 3rd social gathering within the requested digital format.
– Charged greater than the affordable cost-based charges allowed underneath HIPAA.
– OCR supplied help on find out how to appropriate challenge and closed the grievance.
– Data supplied 2 months later after OCR’s second intervention.
$85,000 + CAP w/ 1 12 months of monitoring
3
Sept 2020
– Well timed Entry
– Failed to supply a affected person with copies of his medical data.
– OCR supplied technical help and closed the grievance.
– OCR obtained second grievance that affected person had nonetheless not obtained his data.
– Data supplied Four months later.
$38,000 + CAP w/ 1 12 months of monitoring
4
Sept 2020
– Well timed Entry
– Denied a affected person’s requests to examine and obtain a duplicate of her data.
– Despatched affected person data 16 months later after OCR opened an investigation.
$15,000 + CAP w/ 2 years of monitoring
5
Sept 2020
– Well timed Entry
– Failed to answer request from a private consultant in search of entry to her father’s medical data.
– Data supplied Eight months later after OCR opened an investigation.
$70,000 + CAP w/ 1 12 months of monitoring
6
Sept 2020
– Well timed Entry
– Failed to answer a person’s request for entry to her medical data.
– OCR supplied technical help and closed the grievance.
– OCR obtained second grievance that affected person had nonetheless not obtained her data.
– Particular person obtained her medical data 23 months later.
$3,500 + CAP w/ 2 years of monitoring
7
Sept 2020
– Well timed Entry
– Failed to supply a private consultant with entry to his minor little one’s medical data requested.
– OCR supplied technical help and closed the grievance.
– OCR obtained second grievance that the non-public consultant had nonetheless not obtained the data.
– Data despatched 18 months later.
$10,000 + CAP w/ 1 12 months of monitoring
8
Oct 2020
– Well timed Entry
– Failed to supply a private consultant with entry to minor little one’s medical data starting in January 2018.
– Offered among the requested data, however not all of them regardless of the non-public consultant’s comply with up requests in March, April, and Might 2018.
– All requested medical data supplied in December 2019, greater than 22 months after the preliminary request.
$160,000 + CAP w/ 2 years of monitoring
9
Oct 2020
– Well timed Entry
– Particular person made a number of requests for a duplicate of her medical data.
– Offered among the data, however didn’t present the diagnostic movies particularly requested.
– All requested medical data supplied 16 months after the preliminary request.
$100,000 + CAP w/ 2 years of monitoring
10
Nov 2020
– Well timed Entry
– Correct Denial of Entry to Psychotherapy Notes
– Failed to supply affected person a duplicate of her medical data regardless of a number of requests.
– OCR supplied technical help and closed the grievance.
– OCR obtained second grievance that affected person had nonetheless not obtained the data.
– Lined entity said that as a result of the requested data included psychotherapy notes, it didn’t should adjust to the entry request.
– Nonetheless, entity didn’t comply with HIPAA’s necessities for denying entry to the relevant data and didn’t present entry to all different requested data.
– All requested medical data, minus psychotherapy notes, had been supplied to the affected person 20 months after the preliminary request.
$25,000 + CAP w/ 2 years of monitoring
11
Nov 2020
– Well timed Entry
– Failed to supply a affected person with entry to her medical data.
– OCR supplied technical help and closed the grievance.
– OCR obtained second grievance that affected person had nonetheless not obtained the data.
– All requested medical data supplied 26 months after the preliminary request.
$15,000 + CAP w/ 2 years of monitoring
12
Nov 2020
– Well timed Entry
– Transmission to Third Get together
– Type/Format
– Didn’t well timed present a affected person’s medical data to a 3rd social gathering within the requested digital format.
– Rights embody the proper to have digital data well timed transmitted to a 3rd social gathering.
– Investigation decided that the coated entity didn’t well timed present data per the request.
– Data obtained 6 months after the preliminary request.
$65,000 + CAP w/ 2 years of monitoring