As I’ve noted before, it’s harder for patients to access their medical records then you might think. While providers are bound by both HIPAA and state laws on how to handle medical record requests, as a patient I can tell you that many providers do at most the bare minimum to comply.
In fact, as I shared previously, some organizations don’t even pretend that they take such requests seriously. I often cite the time when I asked a DC-area hospital for my records and was told that I would have to wait three months, even though all they had to do was print it off from their EMR. Because I knew who to call, I was able to get things turned around far more quickly, but for many patients, it never gets easier.
Given my experiences, I was very happy to read that the HHS Office for Civil Rights had recently settled the first case under its Right of Access initiative, an effort focused on “vigorously” enforcing the rights of patients to get copies of their medical records promptly and without facing excessive charges.
OCR cut a deal with Bayfront Health-St. Petersburg, after investigating a complaint from a mother that the facility had failed to give her timely access to records regarding her unborn child. Bayfront is a 480-bed hospital with more than 550 affiliated physicians, so it’s hard to imagine that honoring such a request is a resource issue, but that doesn’t seem to have made a difference in this case.
HIPAA rules generally require covered healthcare providers like Bayfront to give patients their medical records within 30 days of the request and can only charge a reasonable cost-based fee. However, Bayfront didn’t provide the mother with the requested information until nine months after the initial request, and only after OCR had begun its investigation of the mother’s complaint.
In response to the OCR’s enforcement action, Bayfront agreed to pay $85,000 to the agency. In addition to paying the fine, Bayfront has agreed to participate in a corrective action plan that includes one year of compliance monitoring by OCR.
As part of the corrective action plan, Bayfront agreed to take a number of steps designed to bring its record sharing procedures into compliance with federal requirements. These steps include running its updated record request policies past HHS before implementing them, training staff members on the updated process and reporting any time staff members fail to comply with the updated record sharing rules.
Under the terms of the corrective action plan, OCR will track Bayfront’s compliance for one year. That being said, even after the year of compliance monitoring is past, you’d have to imagine that OCR will jump all over Bayfront if it doesn’t seem to be keeping its nose clean. In other words, like it or not this action may force the organization to make long-term changes in how it addresses medical record requests,
I’ll be most interested to see what actions OCR takes on this front in the future. From what I’ve seen, many providers have been disregarding HIPAA rules around medical record requests, and it’s high time to demand that they do better.
