Continuing with its previous enforcement actions centered on covered entities’ failure to provide patients with access to their health records, the Office for Civil Rights (OCR) announced on October 9, 2020 that it entered into a settlement with Dignity Health, doing business as St. Joseph’s Hospital and Medical Center in Phoenix (St. Joseph’s) for $160,000 for failing to respond to multiple requests of a mother for her son’s records.
According to the OCR, a patient’s mother requested on multiple occasions her son’s medical records and St. Joseph’s failed to respond to her requests. She complained to the OCR, which commenced an investigation. Although St. Joseph’s provided partial records within months of the mother’s initial request in January 2018, the request was not fully complied with until December 2019.
The OCR stated “It shouldn’t take a federal investigation to secure access to patient medical records, but too often that’s what it takes when health care providers don’t take their HIPAA obligations seriously.” The OCR warned covered entities by further stating “OCR has many right of access investigations open across the country, and will continue to vigorously enforce this right to better empower patients.”
In addition to the settlement of $160,000, St. Joseph’s is subject to a two-year corrective action plan that requires it to retrain its employees, update its policies and procedures around access to records, and distribute them to employees.
This post is also being shared on our Data Privacy + Cybersecurity Insider blog. If you’re interested in getting updates on developments affecting data privacy and security, we invite you to subscribe to the blog.