Search results for: right of access

Making quite the statement on July 15, 2022, the Office for Civil Rights (OCR) announced in a press release that it had recently settled an additional 11 cases under its Right to Access Initiative. These settlements bring the total number of enforcement actions under the Initiative to 38.

The settlements, ranging from $3,500 to $240,000, resolved enforcement actions with 11 medical and dental practices that allegedly did not provide their patients with access to their medical records. Memorial Hermann Health System in Texas paid the largest settlement in the amount of $240,000. The OCR alleged that Memorial Hermann Health System did not respond to a patient’s request for medical records for a total of 564 days.

The patient made five separate requests for her records from the medical records department between June 2019 and January 2020, and she was not provided with her records in full until March 26, 2021.

The OCR reminds covered entities that the Health Insurance Portability and Accountability Act (HIPAA) requires covered entities to provide access to patient records, absent an extension, within thirty (30) days of the request. The OCR did not take kindly to a response 564 days after the request was first made.

These settlements reiterate that the OCR continues to focus on the Initiative and covered entities’ compliance with patient request for records. It is timely to revisit processes around responses to patient requests for access to records so the response can be compliant with HIPAA.

The Office for Civil Rights (OCR) recently announced that it has entered into the 20th settlement under its Right of Access Initiative. The settlement with Children’s Hospital and Medical Center in Nebraska includes an $80,000 payment by the hospital for failing to provide a mother with timely access to her daughter’s medical records.

According to OCR, after the mother first requested the records, the hospital provided her with some of the records, but failed to provide her with missing records after repeated requests. Once OCR intervened, the hospital provided all of the records to the mother.

In addition to the monetary penalty of $80,000, the hospital entered into a Corrective Action Plan with OCR.

Continuing its serious march against covered entities not allowing patients access to their records, the Office for Civil Rights (OCR) has settled two more cases in two days in its Right of Access Initiative. This brings the tally of OCR’s settlements to a total of 18.

The 17th settlement, with The Arbour, Inc., d/b/a Arbour Hospital (Arbour,), was announced by the OCR on March 24, 2021. The settlement includes a payment of $65,000 and an agreement to enter into a corrective action plan. In that case, the OCR received a complaint in July of 2019 from a patient who alleged that Arbour failed to provide the patient with a copy of the patient’s records.  The request was received by Arbour  in May of 2019.

The OCR provided technical assistance to Arbour, but then received a second complaint from the patient that Arbour still had not provided the patient with the records.

The patient didn’t receive the records until November of 2019. OCR determined “that Arbour’s failure to provide timely access to the requested medical records was a potential violation of the HIPAA right of access standard, which requires a covered entity to take action on an access request within 30 days of receipt (or within 60 days if an extension is applicable.)” In this case, Arbour did not provide the patient with the records for more than five months after the request.

Two days later, on March 26, 2021, the OCR announced it had completed its 18th investigation in the HIPAA Right of Access Initiative when it settled with Village Plastic Surgery (VPS). That settlement included a payment of $30,000 and an agreement to enter into a corrective action plan.

That investigation started after a patient complained in September of 2019 that VPS failed to respond in a timely manner to the patient’s request made in August of 2019. The OCR initiated its investigation and “determined that VPS’s failure to provide timely access to the requested medical records was a potential violation of the HIPAA right of access standard” because VPS did not provide the patient with the records within 30 days. According to the OCR’s press release, “OCR’s Right of Access Initiative continues to support and enforce individuals’ vital right to receive copies of their medical records in a timely manner.”

As with most OCR settlements, these provide a stark reminder that covered entities may wish to revisit processes in place to provide medical records to patients when they are requested, so the requests are responded to in a timely manner.

The Office for Civil Rights (OCR) recently announced another settlement involving investigations under its Right of Access Initiative. This settlement, the sixteenth such agreement under the Initiative (and one of the most interesting), involves San Diego-based Sharp HealthCare, doing business as Sharp Rees-Stealy Medical Centers (SRMC). In the settlement, OCR alleged that it received a complaint on June 11, 2019, stating that SRMC “failed to timely respond” to a patient’s request to electronically access his medical records. OCR provided technical assistance to SRMC and closed the case.

OCR subsequently received a second, similar complaint that SRMC still had not received the medical records as of August 19, 2019. OCR notes in the Resolution Agreement with SRMC that SRMC did not provide access to the requested records until October 15, 2019.

In settling with SRMC, OCR stated that its investigation found that SRMC failed to timely respond to the request for the records from the third-party recipient. SRMC agreed to pay the OCR $70,000 to settle the case and to enter into a standard Corrective Action Plan.

The reason this is so interesting is that it is apparent from reading the Resolution Agreement that the request to access the medical records of the patient did not come directly from the patient, but from a third party. Covered entities are often faced with requests for medical records from third parties on behalf of patients. These third parties could be family members, executors of estates, guardians, administrators, parents, or lawyers. Under HIPAA, covered entities are not permitted to simply hand over medical records to individuals who are not the patient, and requests from third parties can be tricky for many reasons. In general, covered entities are prohibited from providing medical records of patients without the patient’s specific authorization. Although the background detailed facts of this settlement are not known, reading between the lines it looks like the request came from the patient’s attorney.

Covered entities often receive requests for medical records from attorneys, but often are not accompanied by HIPAA-compliant authorization forms to enable the covered entity to provide the medical records to the attorney. Although as attorneys we are used to being able to obtain documents on behalf of clients we represent, HIPAA does not allow covered entities to provide medical records to attorneys without a valid HIPAA authorization form. If an attorney provides the covered entity with a valid authorization form, the request is no different than the request of the patient, and the covered entity must provide access to the records under HIPAA and the OCR’s Right of Access Initiative. The lesson here is to treat the valid request from the attorney no differently than the request from the patient and to provide access to the records within the time frame outlined in HIPAA. Otherwise, the attorney may file a complaint with the OCR.

The Office for Civil Rights (OCR) announced yesterday that it has settled five investigations in its HIPAA “Rights to Access” Initiative (Initiative), which OCR had stated would be an enforcement priority for it starting in 2019. The Initiative is “to support individuals’ right to timely access to their health records at a reasonable cost under the HIPAA Privacy Rule.”

The addition of the five recent settlements brings to seven the total for OCR’s enforcement of the Initiative. The OCR’s press release states that the recent settlement involves five entities: Housing Works, Inc., All Inclusive Medical Services, Inc., Beth Israel Lahey Health Behavioral Sciences and King MD.

Housing Works has agreed to pay OCR $38,000 and to adopt a corrective action plan, resulting from a complaint by an individual that it failed to provide him with a copy of his medical records. OCR provided technical assistance to Housing Works and closed the complaint. A month later, the individual complained to OCR that Housing Works still had not provided the records to him. OCR started an investigation and determined that a violation had occurred. The individual received his records three months later.

All Inclusive Medical Services, Inc. (AIMS) settled the potential violations of HIPAA with a payment of $15,000 to OCR and agreed to adopt a corrective action plan. In that case, OCR received a complaint from an individual that AIMS refused to give her a copy of her records. As a result of the OCR’s investigation, AIMS sent the individual her medical records two years after the initial complaint.

Beth Israel Lahey Health Behavioral Service (BILHBS) has settled allegations of failing to provide access to records by paying $70,000 to OCR and adopting a corrective action plan. The allegations against BILHBS are that a personal representative of a patient requested the medical records of her father, and that BILHBS failed to provide the requested medical records, which OCR indicated was a potential violation of the HIPAA right of access standard. Following OCR’s investigation, the records were sent to the personal representative eight months after they were requested.

King MD, a small provider of psychiatric services, has agreed to pay OCR $3,500 and to adopt a corrective action plan. OCR received a complaint that King MD failed to respond to a request for access to medical records in August 2018. OCR provided technical assistance to King MD, but the individual complained in February 2019 that she still had not been provided with her medical records. OCR started an investigation and determined that the failure to provide access to the records was a potential violation of the HIPAA right-of-access standard. The patient received her medical records in July 2020.

Finally, Wise Psychiatry, PC, a small provider of psychiatric services, has agreed to pay OCR $10,000 and to adopt a corrective action plan. OCR received a complaint that Wise failed to provide a personal representative with access to his son’s medical records. OCR provided technical assistance and closed its investigation. Unfortunately, OCR received a second complaint from the individual that he had not received the records, so OCR initiated an investigation and found that the “failure to provide the requested medical records was a potential violation of the HIPAA right of access standard.” As a result of OCR’s investigation, Wise Psychiatry sent the personal representative his son’s medical records in May 2019.

Messages from these settlements:

  • Comply with the HIPAA right of access requirements.
  • If OCR provides technical assistance, listen, follow and comply with the HIPAA right-of-access requirements.
  • If the right-of-access requirement is not followed after OCR provides technical assistance, and the patient complains to OCR again, it is not likely to close the complaint again, and there is a high risk of having an investigation opened and an eventual monetary settlement made with OCR.

OCR publicly stated on multiple occasions that it would focus on enforcement of the right-of-access requirements starting in 2019, so covered entities may wish to review processes in place around patients’ access to records, as review of compliance is timely in light of these recent settlements.

OCR publicly stated on multiple occasions that it would focus on enforcement of the right-of-access requirements starting in 2019, so covered entities may wish to review processes in place around patients’ access to records, as review of compliance is timely in light of these recent settlements.

On December 12, 2019, the U.S. Department of Health and Human Services Office for Civil Rights (OCR) announced its second “HIPAA Right of Access Initiative” settlement of alleged HIPAA violations.

The HIPAA Right of Access Initiative is a new effort in 2019 by OCR to monitor compliance with HIPAA requirements addressing patient rights to promptly access medical records, in a readily producible format, without being subject to excessive fees. OCR announced its first settlement under the Right of Access Initiative in September 2019 (see our analysis of that settlement here), and this settlement indicates a continued focus by OCR on HIPAA compliance by providers when responding to patient requests for records.

In this case, OCR entered into an $85,000 settlement with Korunda Medical, LLC (Korunda), a Florida-based primary care and pain management provider, after conducting an investigation which indicated that Korunda failed to provide a patient with timely access to protected health information in accordance with the Privacy Rule. According to the resolution agreement, Korunda’s alleged failure to comply with HIPAA’s right of access for individuals came after OCR had received a prior complaint and provided “technical assistance” to Korunda regarding the individual right of access under HIPAA. In addition to the monetary payment, OCR and Korunda entered into a one-year corrective action plan, under which Korunda is obligated review and revise its policies concerning access to medical records, provide workforce training on individual access rights, and submit a list of medical record access requests received by Korunda from individuals every 90 days to OCR after approval of its updated access policies.

This settlement reiterates the importance for covered entities and business associates to review their policies and procedures governing production of medical records in response to patient requests, and the importance of responding to patients in a timely manner. This settlement is also a warning to entities that receive technical assistance from OCR that the government is unlikely to overlook subsequent allegations of non-compliance following such assistance. Finally, it is interesting to note that the monetary settlement here – $85,000 – for alleged violations of HIPAA’s right of access is the same amount extracted by OCR in its first Right of Access Initiative settlement (despite the defendant in that case being a larger entity), suggesting that OCR may view that amount as a “floor” for resolution of potential violations under the HIPAA Right of Access Initiative.

In August, the Office for Civil Rights (OCR) published guidance relating to individuals’ rights to access their protected health information (PHI) under HIPAA. As we covered in our earlier blog post about the August guidance, the new FAQs came amidst OCR’s continued enforcement focus on its Right of Access initiative, under which the OCR has brought over fifty enforcement actions to date.

On September 3, 2025, the U.S. Department of Health and Human Services (HHS) announced Secretary Robert F. Kennedy, Jr.’s crackdown on health data blocking, noting that HHS “will take an active enforcement stance against health care entities that restrict patients’ engagement in their care by blocking the access, exchange, and use of electronic health information.” This announcement signals the agency’s continued focus on patient access rights and healthcare interoperability.

HHS’s September 3rd press release references the 21st Century Cures Act, which was signed into law in 2016 and prohibits information blocking by requiring that patient information stored in electronic health record systems can be “accessed, exchanged, and used without special effort through the use of application programming interfaces.” This is a broad definition of information blocking and could include a provider’s refusal to share patient health records, unreasonable delays in providing requested records, or charging excessive fees for patient access.

The Cures Act imposes requirements on health ecosystem entities beyond providers, too. Health IT developers, for example, may engage in information blocking by executing restrictive contractual terms related to data sharing or disabling interoperability functions on their platforms. Health information exchanges and health information networks are also covered under the Cures Act, and could be found to engage in information blocking by imposing unfair fees to join an exchange or blocking certain organizations without valid justification.

Under the Cures Act, the Office of Inspector General (OIG) and the Office of the Assistant Secretary for Technology Policy/Office of the National Coordinator for Health Information Technology (ASTP/ONC) are authorized to take enforcement action against information blocking in healthcare. In a September 4, 2025, Enforcement Alert following the HHS press release, ASTP warned that individuals found to have engaged in information blocking could face several types of enforcement actions, including civil monetary penalties of up to $1 million per violation against certain health IT developers, entities offering certified health IT, health information exchanges, and health information networks. CMS may also impose disincentives on providers if OIG refers information blocking cases to HHS. Notably, OIG has stated that it will prioritize enforcement where information blocking causes patient harm or significantly impairs a provider’s ability to deliver care.

Proponents of information blocking enforcement assert that these measures will increase patient access to information, promote interoperability, and enhance care coordination. On the other hand, critics note that broad data sharing raises security and privacy concerns. Greater access could increase the risk of breaches or misuse of sensitive health information. While there are exceptions to what constitutes information blocking, aggressive enforcement could pressure organizations into unnecessary disclosure, which runs counter to principles of data minimization and need-to-know sharing. Still, with HHS putting the healthcare ecosystem on alert, now is the time for providers, IT developers, and exchanges to take a look at their data practices. Organizations should not wait for an HHS inquiry to conduct internal audits, assess interoperability capabilities, and ensure any exceptions are well-documented. Overall, data sharing practices should balance appropriate information access with safeguards that prevent patient harm and minimize risk of information being misused. If your organization touches health information in any way, preparation for this increased regulatory focus now could prevent OCR scrutiny later.

On August 11, 2025, the Office for Civil Rights (OCR) published updated guidance relating to the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (Privacy Rule) in the form of two new FAQs. The FAQs clarify the OCR’s position on (1) permitted disclosures of protected health information (PHI) to value-based care arrangements and (2) the scope of PHI that individuals may request access to under the Privacy Rule.

Treatment Disclosures to Value-Based Care Arrangements Are Permitted

Although the Rule typically requires an individual’s authorization for disclosure of their PHI, there are several exceptions, including disclosures for treatment purposes. Under the Privacy Rule, “treatment purposes” includes:

  • The provision, coordination, or management of health care and related services by one or more health care providers;
  • The coordination or management of health care by a health care provider with a third party;
  • Consultation between health care providers relating to a patient; and
  • The referral of a patient for health care from one health care provider to another.”

The new FAQ clarifies that providers may disclose PHI for treatment purposes (without individual authorization) to participants in value-based care arrangements. The OCR notes that providers may still choose to obtain patient consent as a matter of practice. Value-based care is a healthcare model that ties payment to patient outcomes, such as quality and cost of care. Value-based care organizations include accountable care organizations and patient-centered medical homes.

The FAQ guidance is timely given the Centers for Medicare & Medicaid Services (CMS) July 30, 2025, announcement of its CMS Health Tech Ecosystem initiative. According to CMS, the initiative seeks to modernize digital health infrastructure through a voluntary Interoperability Framework, which aims to enhance information exchange and patient empowerment. The framework outlines criteria for participants across the health ecosystem, including health networks, electronic health record vendors, providers, payers, and digital health companies. Over 60 organizations—including Epic, Oracle Health, CVS Health, UnitedHealth Group, Microsoft AI, Google, and Apple—have pledged to become early adopters of the framework.

Against this backdrop, the OCR’s FAQ clarification aligns with CMS’s push for a more connected health data ecosystem, explicitly recognizing value-based care partners as permissible recipients of PHI for treatment purposes.

Request to Access PHI Includes Consent Forms for Treatment

The second new FAQ underscores the broad scope of an individual’s right to access their PHI within a designated record set, which includes medical records, billing records, enrollment files, case management records, and other documents used by providers to make decisions about an individual.

The OCR’s updated guidance specifically highlights that consent forms for treatment are included within the scope of a designated record set. Most providers and legal counsel were likely already treating such forms as subject to access rights, but the FAQ removes any lingering ambiguity.

At the same time, the FAQ reaffirms existing limitations on the right to access. Individuals do not have the right to access PHI that is not part of a designated record set and is not used to make decisions about them, such as:

  • Quality assessment or improvement records;
  • Patient safety activity records; and
  • Business planning documents.

Still, an individual has the right to access any underlying PHI from their designated record set. For instance, while a patient may not access a company’s internal memos related to formulary design, they do retain the right to access their prescription records and related claims data.

The OCR also reiterates that psychotherapy notes (when maintained separately from the medical record) and information compiled in reasonable anticipation of litigation both remain excluded from individual access rights.

This clarification comes in the context of the OCR’s Right of Access Initiative, launched in 2019 to focus enforcement efforts on patient right of access complaints. Since the launch of the initiative, the OCR has announced 53 enforcement actions to date. The most recent settlement, announced in March 2025, imposed a $200,000 civil monetary penalty on a provider that failed to provide timely access to a patient’s records. Providers are reminded that access requests must generally be fulfilled within 30 days and at a reasonable cost. Even though the initiative was launched six years ago, the recent enforcement actions and the new FAQ indicate that enforcement remains an active priority for the agency.

Takeaways

The new FAQs reflect the agency’s ongoing focus on two key areas: facilitating efficient data sharing, and monitoring compliance with patient access rights. For providers and business associates, these developments serve as a reminder to:

  • Review HIPAA policies to allow for and properly document permissible disclosures to value-based care entities;
  • Confirm that designated record sets include consent forms and that these forms are available in response to patient requests to access their PHI;
  • Reinforce processes for timely and cost-compliant responses to patient access requests in light of continued enforcement in this area.

As the federal administration continues to advance initiatives designed to increase interoperability and patient empowerment, health care organizations should proactively align compliance practices with evolving guidance.

Last week, Diabetes, Endocrinology & Lipidology Center Inc. (DELC) of West Virginia reached a $5,000 settlement with the Office for Civil Rights (OCR) over  allegations that it failed to provide timely access to a patient’s health records.   The OCR alleged that DELC waited more than two years to send a minor’s medical records to their parent, and the records were sent only after the OCR opened an investigation in response to the parent’s complaint. This alleged failure to provide timely access was a violation of the Health Insurance Portability and Accountability Act (HIPAA). HIPAA requires health care providers to respond to a patient’s request for access to health records within 30 days.

This is the 19th settlement for alleged right-of-access violations.

In addition to the $5,000 payment, DELC has agreed to implement a corrective action plan and submit to two years of monitoring.

Renown Health, P.C. (Renown), a non-profit health system in Nevada, settled with the U.S. Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services in a matter resulting from an enforcement action for a potential violation of patients’ access rights under the OCR’s Health Insurance Portability and Accountability Act of 1996 (HIPAA) Right-of-Access Initiative. The Renown settlement is the 15th settlement under this initiative.

Renown paid $75,000 and agreed to:

  • Develop and maintain written access policies and procedures to comply with HIPAA
  • Distribute updated policies and procedures related to the right-of-access to all workforce members
  • Train workforce members on the right-of-access
  • Revise its Notice of Privacy Practices to reflect the steps that patients need to take to access their PHI (including billing records)

OCR alleged that Renown did not respond to a patient’s request that an electronic copy of her protected health information (PHI), including billing records, be sent to a third party in a timely manner under HIPAA. The OCR’s investigation determined that this failure to provide timely access was a potential violation of Renown’s obligations to the patient. As a result of the investigation, Renown also provided access to all the requested records.

Acting Director of OCR, Robinsue Frohboese, said “Access to one’s health records is an essential HIPAA right and health care providers have a legal obligation to their patients to provide access to their health information on a timely basis,” and OCR will certainly continue to enforce these types of violations throughout 2021. OCR announced this initiative in September 2019 seeking to support patients’ right to timely access to their PHI at a reasonable cost under HIPAA.

To view the corrective action plan that Renown has agreed to, click here.