The Office of Civil Rights (OCR) is working to enforce the rights of patients, which includes a person’s right to receive copies of his or her medical records promptly and without being overcharged. According to the Code of Federal Regulations Section 164.524, “an individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set, for as long as the protected health information is maintained in the designated record set.” It also states, “the covered entity must act on a request for access no later than 30 days after receipt of the request.”
Recent Enforcement Action: Right of Access Initiative
On September 9, 2019, OCR announced its “first enforcement action and settlement in its Right of Access Initiative.” The settlement resulted in Bayfront Health St. Petersburg (Bayfront) paying OCR $85,000 and with the hospital adopting “a corrective action plan to settle a potential violation of the right of access provision of the Health Insurance Portability and Accountability Act (HIPAA).” Part of this corrective action includes the OCR monitoring the hospital for one year.
The Bayfront Health St. Petersburg (Bayfront) failed to respond within the 30 days of the request for medical records, as outlined in the Code of Federal Regulations. OCR initiated its investigation after the mother filed a complaint stating the hospital failed to provide her with timely access to her unborn child’s medical records.
Providing patients with access to their medical records not only lowers costs, according to OCR, but leads to improved health outcomes. The OCR Director Roger Severino stated, “We aim to hold the health care industry accountable for ignoring peoples’ rights to access their medical records and those of their kids."
Important Takeaways from the Code of Federal Regulations, Section 164.524
- An individual has the right to access, inspect and obtain a copy of their PHI as long as the PHI is maintained in the designated record set.
- Covered entities must act on a request for access no later than 30 days after receipt of the request.
- Covered entities must provide access to the PHI in the form and format requested by the individual if it is readily producible in such form and format. If the requested form and format is not readily producible, the covered entity must provide a readable hard copy or other form and format as agreed upon by the covered entity and the individual.
- A reasonable, cost-based fee may be imposed provided that the fee only includes the cots of labor for copying the PHI, supplies for creating a paper or electronic copy of the PHI, postage, or preparing an explanation or summary of PHI id agreed to be the individual requesting the PHI.
Some exceptions to the rules above apply. See the Code of Federal Regulations, Section 164.524 for more information.
To ensure your organization is in compliance Section 164.524 of the Code of Federal Regulations, contact Rodney Farley by calling 717-213-3123 or email RFarley@LW-Consult.com.
Visit the LWCI Learning Center for various compliance training modules and programs you can implement today.