The Office for Civil Rights (OCR) recently announced another settlement involving investigations under its Right of Access Initiative. This settlement, the sixteenth such agreements under the Initiative, involves San Diego-based Sharp HealthCare, doing business as Sharp Rees-Stealy Medical Centers (SRMC). In the settlement, OCR alleged that it received a complaint on June 11, 2019, that SRMC “failed to timely respond” to a patient’s request to electronically access his medical records. OCR provided technical assistance to SRMC and closed the case.

OCR subsequently received a second, similar complaint that SRMC still had not received the medical records as of August 19, 2019. OCR notes in the Resolution Agreement with SRMC that SRMC did not provide access to the requested records until October 15, 2019.

In settling with SRMC, OCR stated that its investigation found that SRMC failed to timely respond to the request for the records from the third-party recipient. SRMC agreed to pay the OCR $70,000 to settle the case and to enter into a standard Corrective Action Plan.

The reason this is so interesting is that it is apparent from reading the Resolution Agreement that the request to access the medical records of the patient did not come directly from the patient, but from a third party. Covered entities are often faced with requests for medical records from third parties on behalf of patients. These third parties could be family members, executors of estates, guardians, administrators, parents, or lawyers. Under HIPAA, covered entities are not permitted to simply hand over medical records to individuals who are not the patient, and requests from third parties can be tricky for many reasons. In general, covered entities are prohibited from providing medical records of patients without the patient’s specific authorization. Although the background detailed facts of this settlement are not known, reading between the lines it looks like the request came from the patient’s attorney.

Covered entities often receive requests for medical records from attorneys, but often are not accompanied by HIPAA-compliant authorization forms to enable the covered entity to provide the medical records to the attorney. Although as attorneys we are used to being able to obtain documents on behalf of clients we represent, HIPAA does not allow covered entities to provide medical records to attorneys without a valid HIPAA authorization form. If an attorney provides the covered entity with a valid authorization form, the request is no different than the request of the patient, and the covered entity must provide access to the records under HIPAA and the OCR’s Right of Access Initiative. The lesson here is to treat the valid request from the attorney no differently than the request from the patient and to provide access to the records within the time frame outlined in HIPAA. Otherwise, the attorney may file a complaint with the OCR.

Photo of Linn Foster Freedman Linn Foster Freedman

Linn Freedman practices in data privacy and security law, cybersecurity, and complex litigation. She is a member of the Business Litigation Group and the Financial Services Cyber-Compliance Team, and chairs the firm’s Data Privacy and Security and Artificial Intelligence Teams. Linn focuses her…

Linn Freedman practices in data privacy and security law, cybersecurity, and complex litigation. She is a member of the Business Litigation Group and the Financial Services Cyber-Compliance Team, and chairs the firm’s Data Privacy and Security and Artificial Intelligence Teams. Linn focuses her practice on compliance with all state and federal privacy and security laws and regulations. She counsels a range of public and private clients from industries such as construction, education, health care, insurance, manufacturing, real estate, utilities and critical infrastructure, marine and charitable organizations, on state and federal data privacy and security investigations, as well as emergency data breach response and mitigation. Linn is an Adjunct Professor of the Practice of Cybersecurity at Brown University and an Adjunct Professor of Law at Roger Williams University School of Law.  Prior to joining the firm, Linn served as assistant attorney general and deputy chief of the Civil Division of the Attorney General’s Office for the State of Rhode Island. She earned her J.D. from Loyola University School of Law and her B.A., with honors, in American Studies from Newcomb College of Tulane University. She is admitted to practice law in Massachusetts and Rhode Island. Read her full rc.com bio here.