Diagnostic Lab Settles Medical Record Access Case for $16,500
The HHS’ Office for Civil Rights (OCR) has announced its first HIPAA enforcement action of 2023, which serves as a reminder that individuals and their personal representatives must be provided with timely access to their medical records. Life Hope Labs, LLC, has agreed to settle the case and will pay a $16,500 penalty.
43 Enforcement Actions for HIPAA Right of Access Failures
The HIPAA Right of Access requires covered entities to provide a copy of an individual’s protected health information that is maintained in a designated record set within 30 days of receipt of that request. In certain circumstances, a delay of up to 30 days is permitted, provided the individual is notified about the reason for the delay and the individual is informed in that response when the request will be satisfied.
OCR launched a new HIPAA compliance initiative in the fall of 2019 targeting organizations that were not providing individuals and their personal representatives with a copy of the requested medical records in a timely manner, and organizations that were charging unreasonable fees for providing those records. Including the latest settlement, OCR has imposed financial penalties on 43 healthcare organizations for potential HIPAA Right of Access violations.
Life Hope Labs Enforcement Action
Life Hope Labs is a Sandy Springs, GA-based full-service diagnostic laboratory. On August 24, 2021, OCR received a complaint from the personal representative of a patient’s estate for the medical records of the decedent. The complainant alleged a request had been made with Life Hope Labs on July 7, 2021, but the records were not provided. It took Life Hope Labs seven months (225 days) from the initial request to provide those records. The complainant – the daughter of the decedent – received the complete set of records on February 16, 2022. OCR confirmed that the delay in providing the requested records was a violation of the HIPAA Right of Access, as detailed in 45 C.F.R. § 164.524.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Life Hope Labs agreed to settle the case with OCR and paid a $16,500 penalty to settle the potential HIPAA Right of Access violation, with no admission of wrongdoing. Under the terms of the settlement, Life Hope Labs is required to adopt a corrective action plan that includes the requirement to develop, maintain, and revise, as necessary, written policies regarding the HIPAA Privacy Rule, including the right of patients to access and obtain a copy of their PHI and to distribute those policies to all members of the workforce. HIPAA training on those policies must also be provided to all new staff members within 30 days of commencing employment. The settlement also includes two years of monitoring.
“Access to medical records, including lab results, empowers patients to better manage their health, communicate with their treatment teams, and adhere to their treatment plans. The HIPAA Privacy Rule gives individuals and personal representatives a right to timely access their medical records from all covered entities, including laboratories,” said OCR Director Melanie Fontes Rainer. “Laboratories covered by HIPAA must follow the law and ensure that they are responding timely to records access requests.”
