On October 17, 2024, the HHS Office for Civil Rights (“OCR”) announced a $70,000 civil monetary penalty (“CMP”) against a Maryland dental practice for allegedly failing to provide a patient with timely access to their medical records. After receiving multiple complaints that the practice failed to provide a patient access to her and her children’s medical records, OCR opened an investigation and found that even though the patient had submitted written requests for the records in April 2019 and May 2019, the dental practice did not provide the records until May 2022. OCR issued a Notice of Proposed Determination seeking to impose the $70,000 CMP, which was challenged by the dental practice and subsequently affirmed by an Administrative Law Judge (“ALJ”). The dental practice also challenged the ALJ’s decision, but it was affirmed by the Departmental Appeals Board.
HHS Office for Civil Rights Imposes $70,000 CMP for Failure to Provide Timely Access to Patient Records
The CMP was OCR’s 50th right of access information action. In the press release, OCR Director Melanie Fontes Rainer was quoted saying: “Patients should not have to make multiple requests and file complaints with HHS’ Office for Civil Rights to get their own medical records . . . Health care providers should get the message–loud and clear–when a patient seeks their medical information, you must provide it to them, period.”
The HIPAA Privacy Rule establishes national standards to protect individuals’ medical records, sets limits and conditions on the uses and disclosures of protected health information, and gives individuals certain rights, including the right to timely access and to obtain a copy of their health records.The Privacy Rule’s right of access provisions require that individuals or their personal representatives have timely access to their health information (within 30 days) and for a reasonable, cost-based fee.