In a new right-of-access case, the HHS Office for Civil Rights (OCR) has slapped a $100,000 fine on Essex Residential Care LLC, doing business as Hackensack Meridian Health, West Caldwell Care Center (WCCC), a skilled nursing facility in New Jersey, because it took 161 days to send medical records to a patient’s son. OCR was unswayed by WCCC’s arguments that it was in the midst of a lawsuit with the mother and son and in the throes of the COVID-19 pandemic, according to the notice of final determination.^[1]

So far, there have been 48 enforcement actions under OCR’s Right-of-Access Initiative. Usually they end with settlements, but this time it’s a civil monetary penalty (CMP). WCCC accepted OCR’s final determination and waived its right to an administrative law judge hearing.

“This is just another reminder that covered entities have to timely respond to an individual’s request for access to their medical records,” said attorney Debra Geroux, with Butzel Long. “HIPAA says you have to do it in 30 days with a few exceptions.” For example, HIPAA allows covered entities to withhold psychotherapy notes, she said. Giving people their medical records in 30 days (unless an extension is needed and it’s explained to the requestor) is not a big ask, Geroux said. “Is it acceptable to simply print off everything in your electronic medical records and give it to the individual? Yes,” she said. Or give it to them in an electronic format if that’s their preference. “It’s one person’s medical records and it should all be self-contained.”