Exceed The Time and Pay The Dime! Right to Access Law

Failure to provide access to one patient’s request of access to his/her medical records can lead to a hefty penalty for Health Care Providers (Covered Entities). The Office for Civil Rights settles their 16th case of the Right to Access Initiative enforcement that went into effect at the end of 2019. Sharp Health Care had to pay a $70,000 penalty for failure to take timely action in response to a patient’s records access request.

Privacy Rule

According to the privacy rule, 45 CFR § 164.524, Health Care Providers must provide access to the protected health information requested no later than 30 calendar days from receiving the individual’s request. Covered entities are encouraged to respond as soon as possible as the 30 calendar days is considered an outer limit. We must meet the time or pay the dime! Please also check with your state for more stringent requirements. For example, the State of Tennessee is 10 working days.

Penalties

Here are some of the previous penalties imposed on the Right to Access Law of exceeding the time and paying the dime:

• $85,0000 – Failed to forward patient request in electronic format to a 3rd party
• $38,000 – Failed to provide patient copy of his medical records
• $15,000 – denied request to patient to inspect her records and give a copy
• $70,000 – Failed to provide personal representative copies of father’s medical records
• $3,500 -Failed request of patient to access her medical records
• $10,0000 – Failed to provide personal representative copies  of minor son’s medical records
• $160,000 – Failed to provide mother’s request for copy of son’s medical records
• $100,000 -Failed to provide patient’s request of her medical records

New Changes

The OCR is proposing new changes in the Privacy rule for 2021 and is currently in review for public comments. One of the proposed changes is to shorten the required response time from 30 days to 15 days. Stay tuned with Modern Practice Solutions on the Privacy Rule changes.

Modern Practice Solutions

For more information and training on the Privacy Rule & the Right to Access Law, reach out to us at Modern Practice Solutions! We are here to assist you and your team with your HIPAA Compliance.