WASHINGTON, D.C. — The U.S. Department of Health and Human Services (HHS), through its Office for Civil Rights (OCR), has imposed a $200,000 civil monetary penalty on Oregon Health & Science University (OHSU) for violating a patient’s right to timely access to medical records under the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA).
The penalty marks a significant enforcement action under HIPAA’s Privacy Rule, specifically its “Right of Access” provisions. These rules ensure that individuals or their authorized representatives can request and receive medical records from healthcare providers or health plans in a timely manner, typically within 30 days.
Details of the Violation
OCR’s investigation into OHSU began following a complaint filed in January 2021 by a personal representative of a patient. This complaint came after OCR had already resolved a prior complaint on the same matter back in September 2020. The initial complaint, submitted in May 2020, highlighted OHSU’s delay in providing certain requested medical records.
Although some of the requested records were provided in April 2019, OCR’s findings revealed that OHSU failed to deliver all of the required records within the mandated timeline. Instead, it took until August 2021—16 months after the first request and nearly a year after OCR’s warning letter in September 2020—for OHSU to fully comply.
Federal Enforcement
OCR’s investigation concluded that OHSU’s delays constituted a failure to adhere to the HIPAA Privacy Rule’s Right of Access provisions. These regulations are designed to protect patients’ ability to access their health information and authorize representatives to review or obtain medical records on their behalf. Acting OCR Director Anthony Archeval reiterated the responsibility of covered entities to fulfill these requests promptly, even when third-party contractors are involved.
“The HIPAA Privacy Rule requires that individuals and their personal representatives receive timely access to their medical records,” Archeval stated. “A covered entity’s responsibility to provide timely access continues, even when a covered entity contracts with a business associate to respond to HIPAA right of access requests.”
Financial Penalty and Implications
Following its investigation, OCR issued a Notice of Proposed Determination in September 2024 recommending a $200,000 penalty. OHSU waived its right to a hearing and agreed to the penalty without contest. Consequently, OCR finalized the determination in December 2024, officially concluding the case.
The penalty underscores the federal government’s focus on enforcing patients’ rights and holding healthcare institutions accountable for compliance with data privacy regulations.
Broader Impact
This case exemplifies the ongoing efforts of HHS and OCR to ensure that patients and their authorized representatives can obtain medical records without unnecessary delays. The enforcement action sends a clear message to healthcare providers and entities covered under HIPAA that failure to comply with federal privacy regulations will result in financial and reputational consequences.
OHSU, as a prominent academic medical center and research institution, is now under increased scrutiny for its handling of patient data. The $200,000 penalty serves as both a resolution to this specific case and a reminder of the importance of adhering to data privacy laws.
HHS has emphasized that it will continue to prioritize the enforcement of the HIPAA Privacy Rule, citing the critical role timely access to medical records plays in safeguarding patient rights and improving healthcare outcomes. This penalty against OHSU demonstrates the department’s broader strategy to ensure compliance across the healthcare industry.
For the latest news on everything happening in Chester County and the surrounding area, be sure to follow MyChesCo on Google News and MSN.