OCR Announces Latest in Right of Access Enforcement Actions With Imposition of Civil Monetary Penalty

On August 1, 2024, the U.S. Department of Health and Human Services, Office for Civil Rights (“OCR”) announced the imposition of a civil monetary penalty (“CMP”) of $115,200 collected against American Medical Response (“AMR”), a provider of emergency medical services across the United States. This CMP marks the 49th enforcement action taken by OCR pursuant to its Right of Access Initiative.

OCR enforces the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), which, among other things, provides individuals or their personal representatives a right to timely access to their health information (within 30 days, with the possibility of one 30-day extension) for a reasonable, cost-based fee. When covered entities fail to satisfy this requirement, they face the risk of OCR enforcement.

On July 29, 2019, OCR received a complaint alleging that AMR failed to provide a patient with timely access to medical records after many requests by the patient. OCR also noted in its Notice of Proposed Determination that AMR did not respond to the patient’s requests until March 1, 2019, 121 days after the initial request, when AMR sent the patient an invoice requiring payment before AMR would provide the requested records. The patient subsequently filed the complaint with OCR, and OCR initiated an investigation that found AMR failed to provide the patient with timely access to the requested medical records. In response to OCR’s investigation, AMR sent the patient a copy of the requested records on November 5, 2019 (370 days after the patient’s initial request), and amended its internal procedures to streamline and better track right of access requests to follow the law.

OCR notified AMR of the results of the investigation on August 3, 2021, and offered AMR an opportunity to resolve the matter informally. OCR has wide discretion in enforcement actions, with options ranging from technical assistance, to settlement, to the imposition of CMPs. However, OCR indicates that AMR did not engage in negotiations. Accordingly, in October 2023, OCR issued a Notice of Proposed Determination seeking to impose a civil monetary penalty. AMR waived its right to a hearing and did not contest OCR’s findings. OCR finalized its determination and imposed the civil monetary penalty against AMR.

This latest enforcement action reiterates OCR’s continued focus on patient right of access to records and highlights the length of time that investigations and ultimate resolutions can take. Covered entities should continue to focus efforts on timely, thorough responses to requests for medical records and address process hurdles as a compliance priority. For more information, please contact AGG Healthcare partner Madison Pool.