OCR Settles Eighth Investigation in HIPAA Right of Access Initiative

The Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) announces that it has settled its eighth enforcement action in its HIPAA Right of Access Initiative. OCR announced this initiative as an enforcement priority in 2019 to support individuals’ right to timely access to their health records at a reasonable cost under the HIPAA Privacy Rule.

Dignity Health, doing business as St. Joseph’s Hospital and Medical Center (“SJHMC”), has agreed to take corrective actions and pay $160,000 to settle a potential violation of the HIPAA Privacy Rule’s right of access provision.  JHMC, based in Phoenix, is a large, acute care hospital with several hospital-based clinics that provide a wide range of health, social and support services.

On April 25, 2018, OCR received a complaint from a mother alleging that beginning in January 2018, she made multiple requests to SJHMC for a copy of her son’s medical records, as his personal representative.  SJHMC provided some of the requested records, but despite the mother’s follow up requests in March, April and May 2018, SJHMC did not provide all of the requested records. OCR initiated an investigation and determined that SJHMC’s actions were a potential violation of the HIPAA right of access standard.  As a result of OCR’s investigation, SJHMC sent all of the requested medical records to the mother on December 19, 2019, more than 22 months after her initial request.

Click here to read the full release.