HHS Civil Rights Office Resolves HIPAA Right of Access Investigation with $20,000 Settlement

Today, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services announced a settlement with Health Specialists of Central Florida Inc., a provider in Florida that provides primary care, concerning a potential violation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule's right of access provision. The rule requires that patients be able to access their health information in a timely manner. This investigation marks the 42nd case to be resolved under OCR’s HIPAA Right of Access Initiative, designed to improve compliance by regulated entities with the law. Health Specialists of Central Florida Inc. paid $20,000 to OCR and agreed to implement a corrective action plan (CAP) to resolve this investigation.

“The right of patients to access their health information is one of the cornerstones of HIPAA, and one that OCR takes seriously. We will continue to ensure that health care providers and health plans take this right seriously and follow the law,” said OCR Director, Melanie Fontes Rainer. “Today’s announcement speaks to the importance of accessing information and regulated entities taking steps to implement i procedures and workforce training to ensure that they are doing all they can to help patients access.”

In August 2019, a complaint was filed by a daughter acting as a personal representative on behalf of her deceased father, who had been a patient of Health Specialists of Central Florida Inc. The complainant alleged that Health Specialists of Central Florida Inc.  had failed to provide her with timely access to the requested medical records, despite multiple requests.

OCR’s investigation determined that Health Specialists of Central Florida Inc.'s failure to provide timely access to the requested medical records was a potential violation of the HIPAA right of access standard, which requires a covered entity to take action on an access request within 30 days of receipt (or within 60 days if an extension is applicable). As a result of OCR's investigation, the daughter finally received all of the requested records, nearly five months after her initial request.

In addition to the monetary settlement, Health Specialists of Central Florida Inc. will undertake a corrective action plan that includes two years of monitoring. A copy of the resolution agreement and corrective action plan may be found at: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/health-specialists-ra-cap/index.html.

OCR’s guidance on the right of access is available at https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html.

OCR is committed to ensuring that the privacy and security of peoples’ health information is protected under HIPAA. If you believe that your or another person’s health information privacy or civil rights have been violated, you can file a complaint with OCR at: https://www.hhs.gov/ocr/complaints/index.html.