The HHS’ Office for Civil Rights (OCR) reported its first HIPAA enforcement action of 2023. The agency is reminding HIPAA-regulated entities of their obligation to provide patients and their personal representatives with prompt access to their health documents. Life Hope Labs, LLC, has consented to pay the $16,500 penalty to resolve the case.
43 Enforcement Actions Issued Due to HIPAA Right of Access Failures
The HIPAA Right of Access calls for covered entities to give a copy of an individual’s protected health information (PHI) that is kept in a specified record set in 30 days of receiving that request. In particular instances, it is permitted to delay up to 30 days, as long as the person is informed concerning the cause for the delay and simultaneously advised when the request is going to be fulfilled.
OCR announced a new HIPAA compliance initiative in 2019 focusing on companies that weren’t giving people and their personal representatives a copy of the medical records they asked for promptly, and companies that were billing irrational fees for giving those records. Including the most recent settlement, OCR has charged financial penalties on 43 healthcare companies for probable violations of HIPAA Right of Access.
Life Hope Labs Enforcement Action
Life Hope Labs located in Sandy Springs, GA offers diagnostic lab services. On August 24, 2021, the personal representative of a patient’s estate submitted a complaint with the OCR. The complainant claimed that it filed a request for a copy of the health documents of the deceased with Life Hope Labs on July 7, 2021, however, the provider didn’t give the files. It took Life Hope Labs seven months from the preliminary request to deliver those documents. The complainant, who is the decedent’s daughter, obtained a complete copy of the records on February 16, 2022. OCR established that the delay in delivering the needed information violated the HIPAA Right of Access, as specified in 45 C.F.R. § 164.524.
Life Hope Labs decided to settle the case and paid OCR a $16,500 penalty for the likely violation of the HIPAA Right of Access, without confessing to any wrongdoing. As per the conditions of the settlement, Life Hope Labs needs to undertake a corrective action plan that consists of the need to create, maintain, and modify, as required, written guidelines concerning the HIPAA Privacy Rule, such as the right of patients to get access to and acquire a copy of their PHI and to send those policies to all employees. HIPAA training on those guidelines must additionally be provided to all new staff members within 30 days of starting work. The settlement likewise includes 24 months of supervision.
Access to medical records, including laboratory results, allows patients to better take care of their health, connect with their treatment groups, and follow their treatment plans. The HIPAA Privacy Rule provides individuals and personal reps a right to timely access to their health documents from all covered entities, for instance, laboratories. HIPAA-regulated laboratories should stick to the law and make sure that they are responding promptly to requests for medical records access.