On March 29, 2024, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced a settlement agreement with Phoenix Healthcare. Phoenix Healthcare is an Oklahoma multi-facility nursing care organization. The settlement agreement addresses the potential Health Insurance Portability and Accountability Act (HIPAA) Right of Access provision violation. The HIPAA Right of Access provision requires individuals or their representatives to have timely access to their health information. A covered entity must provide access to the protected health information within 30 days of receiving an individual’s request.
In the Phoenix Healthcare matter, a daughter acted as her mother’s personal representative and requested access to her mother’s protected health information. In April 2019, a complaint was filed with OCR alleging that Phoenix Healthcare failed to provide the daughter with a copy of her mother’s medical records within the required timeframe. After technical assistance and attempts to get the records by OCR, Phoenix Healthcare sent the record 323 days after the request on January 30, 2020.
Phoenix Healthcare will pay a $35,000 civil monetary penalty, provide OCR with copies of its workforce training materials, and update its policies and procedures to reflect the HIPAA Right of Access provision. Phoenix Healthcare will be required to pay the $75,000 civil monetary penalty in full if they do not adhere to all of the settlement agreement’s conditions.