March 26, 2021
The Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services announces its eighteenth settlement of an enforcement action in its HIPAA Right of Access Initiative. OCR announced this initiative to support individuals' right to timely access of their health records at a reasonable cost under the HIPAA Privacy Rule.
Village Plastic Surgery ("VPS") has agreed to take corrective actions and pay $30,000 to settle a potential violation of the HIPAA Privacy Rule's right of access standard. VPS is located in New Jersey and provides cosmetic plastic surgery services.
In September 2019, a complaint was filed with OCR alleging that VPS failed to take timely action in response to a patient's records access request made in August 2019. OCR initiated an investigation and determined that VPS’s failure to provide timely access to the requested medical records was a potential violation of the HIPAA right of access standard, which requires a covered entity to take action on an access request within 30 days of receipt (or within 60 days if an extension is applicable). As a result of OCR's investigation, VPS sent the patient their requested records.
“OCR’s Right of Access Initiative continues to support and enforce individuals’ vital right to receive copies of their medical records in a timely manner," said Acting OCR Director Robinsue Frohboese. “Covered entities must comply with their HIPAA obligations and OCR will take appropriate remedial actions if they do not.”
In addition to the monetary settlement, VPS will undertake a corrective action plan that includes two years of monitoring. A copy of the resolution agreement and corrective action plan may be found at https://www.hhs.gov/sites/default/files/village-plastic-surgery-ra-cap.pdf - PDF.*
https://www.hhs.gov/about/news/2021/03/26/ocr-settles-eighteenth-investigation-hipaa-right-access-initiative.html