OCR Highlights HIPAA Enforcement Actions Under Right Of Access Initiative – Privacy & More News Here – Upjobsnews

On March 28, 2022, the U.S. Department of Health and Human
Services (HHS) Office for Civil Rights (OCR) announced the
resolution of three investigations and one matter before an
Administrative Law Judge related to compliance with the Health
Insurance Portability and Accountability Act (HIPAA) Privacy
Rule.

In a press release, OCR Director Lisa Pino stated
that “OCR will continue our steadfast commitment to protect
individuals’ health information privacy and security through
enforcement, and we will pursue civil money penalties for
violations that are not addressed.”

These actions and the statements from Director Pino make it
clear that OCR will continue to focus on right of access
initiatives. Additionally, covered entities such as health care
providers are only permitted to use and disclose patient PHI as
permitted by HIPAA rules. These enforcement actions also reinforce
the need to have robust HIPAA policies and procedures in place and
for health care providers to ensure their workforce and
administrators are routinely trained on HIPAA compliance.

Two of the cases are part of OCR’s HIPAA Right of Access
Initiative, bringing the total number of these enforcement actions
to 27 since the initiative began. OCR created this initiative to
enforce individuals’ right to timely access their health
records at a reasonable cost under the HIPAA Privacy Rule. The
other enforcement actions result from health care providers
impermissibly disclosing their patients’ protected health
information (PHI).

The enforcement actions highlighted by OCR include:

1. A solo dental practitioner in Butler, Pa. entered into a
   settlement agreement with OCR. In this case, the dental practice
   failed to provide a patient with a copy of the patient’s
   medical record, agreed to pay $30,000 and take corrective actions
   to comply with the HIPAA Privacy Rule’s right-of-access
   standard, including implementing and distributing HIPAA policies
   and procedures and training each workforce member on them. The
   settlement agreement with OCR is available here.




2. A California-based psychiatric medical services provider agreed
   to take corrective action and pay OCR $28,000 to settle potential
   violations of the HIPAA Privacy Rule, including provisions of the
   right-of-access standard. The investigation revealed that the
   provider failed to respond to a patient’s mailed written access
   request for medical records. The provider later provided medical
   records to the patient, only provided the records electronically
   after the patient traveled to the provider’s office to complete
   its form to exercise the right to access, imposing a flat fee that
   was not cost-based ($25 per medical records request), and initially
   providing an incomplete (one page) paper copy of the records.
   Additionally, the investigation determined that the provider failed
   to designate a privacy official and its Notice of Privacy Practices
   lacked required content. Accordingly, this provider was required to
   remedy these deficiencies as part of the settlement with OCR. The
   complete resolution agreement with OCR and corrective action plan
   is available here.




3. OCR imposed a $50,000 civil monetary penalty on a North
   Carolina-based dental practice. OCR found that the dental practice
   impermissibly disclosed a patient’s PHI on a webpage in
   response to a negative online review. The practice did not respond
   to OCR’s data request, did not respond or object to an
   administrative subpoena, and waived its rights to a hearing by not
   contesting OCR’s findings. OCR’s Notice of Final
   Determination is available here.




4. A dental practice in Fairhope, Ala., entered into a resolution
   agreement with OCR and agreed to take corrective action and pay
   $62,500 to settle potential violations of the HIPAA Privacy Rule.
   OCR found that the dental practice impermissibly disclosed the name
   and address of approximately 3,658 individual patients to a
   campaign manager and the names and email addresses of approximately
   5,385 individual patients to a third-party marketing company hired
   to help with the practice owner’s primary election in the
   Alabama state senate. OCR’s investigation determined that the
   practice did not designate a privacy official or implement HIPAA
   policies and procedures. The practice was required to remedy these
   deficiencies as part of the settlement with OCR. The complete
   resolution agreement with OCR and corrective action plan is
   available here.

www.dinslaw.com

The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.