As the HHS Office for Civil Rights (OCR) continues its crackdown on providers that fail to comply with the HIPAA right of access, privacy experts warn that it’s past time for covered entities (CEs) and business associates (BAs) to upgrade their access policies and procedures, and to take the right of access very seriously.
In February, OCR announced the 15th and 16th settlements in its Right of Access Initiative. On Feb. 10, Renown Health P.C., a private nonprofit health system in Nevada, agreed to take corrective actions and pay $75,000 to settle a potential violation of the right of access standard.[1] And just two days later, Sharp HealthCare, doing business as Sharp Rees-Stealy Medical Centers, agreed to take corrective actions and pay $70,000 to settle a potential violation.[2]
Attorney Samantha Gross, associate with Saul Ewing Arnstein & Lehr LLP in Philadelphia, said multiple issues play into these potential violations. There is often confusion on the part of the covered entity as to how to comply with these specific HIPAA rules, in particular with unique requests such as from third parties (as seen in the recent Renown settlement) or requesting psychotherapy notes (as seen in the Riverside Psychiatric Medical Group settlement[3] in November). There is also an administrative burden of replying to such requests in a timely manner when CEs have a number of other demands. However, compliance with the HIPAA rules, including the right of access, remains critical, Gross told RPP.
In addition, some CEs simply aren’t paying enough attention to this requirement, noted Rebecca Herold, president of SIMBUS360 and CEO of The Privacy Professor. “While most CEs, in my experience, have assigned, even in some offhand verbal instance, responsibility for this activity, they typically have then [done] nothing beyond that; no plans or procedures were made to guide and consistently take actions for responding to such requests. They have neglected an important part of being able to respond in a timely manner—to meet the time requirements of this HIPAA requirement,” Herold said.
