OCR Announces 53rd Right of Access Enforcement Action
4/1/2025
On March 6, 2025, the OCR announced the resolution of an enforcement action brought against a public academic health center and research university relating to allegations that the university failed to provide timely access to an individual of the individual’s health records. Under HIPAA, covered entities must provide access to an individual’s health records (including access to personally view or receive copies of records) within thirty days of the request. In this instance, the affected individual’s personal representative made a number of valid requests for copies of the individual’s medical records. Although partial records were provided in response to some of the requests, the complete requested records were not provided until more than a year after the initial request and after the filing of two complaints with the OCR. In September 2024, OCR issued a Notice of Proposed Determination seeking to impose a $200,000 civil monetary penalty against the university. The university waived its right to a hearing and did not contest the OCR’s imposition of a civil monetary penalty. Therefore, in December 2024, the OCR finalized its determination and imposed the penalty against the university. The action represents the 53rd right of access settlement since the OCR began the initiative in early 2019. The OCR has indicated its intent to vigorously support and enforce an individual’s right to view and obtain copies of medical records within the timeframes required under HIPAA.
Click Here to read the entire April 2024 Healthcare Law Update now!
If you need assistance with your privacy and security program, contact:
Lani M. Dornfeld, CHPC | 973.403.3136 | ldornfeld@bracheichler.com
Lani M. Dornfeld
CHPC, Member
Healthcare Law, Cannabis Industry
973.403.3136 · 973.618.5536 Fax
ldornfeld@bracheichler.com
