When Roger Severino, the director of the HHS Office for Civil Rights (OCR), asked his doctor’s office for a copy of his lab test results, he had a first-hand experience with the problems that patients may face exercising their right of access to medical records under HIPAA. Severino was told he could get his records from the doctor’s portal, but when he logged on, it required a significant annual fee. Severino called the doctor’s office and said he just wanted the lab test results using his right of access under HIPAA, explaining where information about it could be found on the OCR website without mentioning his job title. “It was impenetrable the number of emails I had to send back and forth to the point where I gave up. It was taking too much time,” Severino said Nov. 5 at the Health Care Compliance Association’s Healthcare Enforcement Compliance Conference. “If it was me having to go through that, I can only imagine how it was for other folks who can’t cite the regulations.” His physician has since changed the portal so records are available for free.

Because of noncompliance with the right of access under HIPAA, which requires covered entities (CEs) to give patients access to their protected health information (PHI) in one or more “designated record sets” within 30 days of the request, OCR is considering regulatory changes and pursuing enforcement actions under its Right of Access Initiative. So far, there has been one resolution agreement—with Bayfront Health St. Petersburg in Florida—but “there are many more in the pipeline,” Severino said.

There are several dimensions to the noncompliance. “We have been working hard to make sure covered entities know they have a duty” to give patients their records in a timely manner and only charge “allowable costs, but we have seen overcharging,” he explained. There also are issues around the form and format of records. “If patients want [their records] by email, covered entities should give it to them in that format. We want to empower the patients, because sometimes it’s a question of life or death,” Severino said. For example, the patient could be switching doctors and need the medical records immediately. “You want to get the medical records in the right hands at the right time.”