October 01, 2019

Hospital Fined in HIPAA Right of Access Violation

By Charlie Sabatino
Florida hospital fine for ignoring expectant mother's right to her unborn child's medical record.

Florida hospital fine for ignoring expectant mother's right to her unborn child's medical record.

(The pdf for the issue in which this article appears is available for download: Bifocal, Vol. 41, Issue 1.)

In its first enforcement action involving its Right of Access Initiative, the Office of Civil Rights (OCR) at the U.S. Department of Health and Human Services cited a Florida hospital in September for failing to give an expectant mother timely access to her unborn child’s medical records. Under Health Insurance Portability and Accountability Act (HIPAA) rules, providers have a maximum 30 days to comply with these requests. It took more than nine months for the hospital, Bayfront Health St. Petersburg, to provide the mother with her requested prenatal health records.

OCR Director Roger Severino said in a statement: “We aim to hold the health care industry accountable for ignoring peoples’ rights to access their medical records and those of their kids. Providing patients with their health information not only lowers costs and leads to better health outcomes, it’s the law.”

The Health Insurance Portability and Accountability Act first mandated the creation of privacy standards for personally identifiable health information in 1996. The set of privacy regulations promulgated under HIPAA, known as the Privacy Rule (45 CFR Part 164), defines the types of uses and disclosures of an individual’s health information that are permitted by health care providers and health plans.  That same rule guarantees access to one’s own information through multiple pathways.  The Act provides for a right to access.  Nevertheless, almost all enforcement actions by the OCR, the designated enforcer, have been for improper disclosures and breaches of information security by health care providers and related business covered by the Act.

The latest OCR enforcement action and settlement against Bayfront is the first of its kind since OCR announced the Right of Access Initiative earlier this year, promising to vigorously enforce the rights of patients to receive copies of their medical records promptly and without being overcharged.

 Bayfront has agreed to pay $85,000 to OCR and has adopted a corrective action plan to settle the alleged violation of the right of access provision of HIPAA.  Bayfront, based in St. Petersburg, is a Level II trauma and tertiary care center licensed as a 480-bed hospital with over 550 affiliated physicians.  Here’s the resolution agreement and corrective action plan.  

OCR said it initiated its investigation into HIPAA violations based on a complaint from the mother.  “This right to patient records extends to parents who seek medical information about their minor children, and in this case, a mother who sought prenatal health records about her child,” it said.

This case is an important reminder of the need to understand the information access rules that apply to you, your health care representative, and your family members or friends.  OCR’s website provides an excellent overview of those rights, including helpful videos.

You have a right to have your health care provider send your medical information to anyone you choose. While the provider must give you more than one way to make this kind of request, one alternative is to use a tool created by the ABA Commission on Law and Aging, a Right to Access Form.