HHS Office for Civil Rights Enters Into $15,000 Settlement Resolving Potential HIPAA Violation Under the Right of Access Initiative

Today, the U.S. Department of Health and Human Services’ Office for Civil Rights announced a settlement with David Mente, MA, LPC (“Mente”), a licensed counselor providing psychotherapy services in Pittsburgh, Pennsylvania, concerning a potential violation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule's right of access provision. The rule requires that patients be able to access their health information in a timely manner. This investigation marks the 44th case to be resolved under OCR’s HIPAA Right of Access Initiative, designed to improve compliance by regulated entities with the law.  Under the resolution agreement (RA), Mente must respond to the right of access request without delay, implement a corrective action plan (CAP) to be in compliance with the HIPAA Privacy Rule and pay a resolution amount of $15,000.

In December of 2017, a complaint was filed with OCR alleging that Mente would not provide a father (personal representative) with a copy of his three minor children’s medical records. OCR provided technical assistance to Mente on the requirements of the HIPAA Privacy Rule’s right of access requirements and closed the complaint. The father requested his children’s records again in April 2018, and despite OCR’s prior technical assistance, Mente still failed to respond to the request, leading to the father filing a second complaint. OCR’s investigation of this complaint determined that Mente’s failure to provide timely access to the requested medical records was a potential violation of the HIPAA right of access provision.

“Under HIPAA, parents, as the personal representatives of their minor children, generally have a right to access their children’s medical records,” said OCR Director Melanie Fontes Rainer. “It should not take an individual or their parent representative nearly six years and multiple complaints to gain access to patient records.  HIPAA regulated entities should be proactive and work to ensure patients and their representatives can access records.”

As part of the CAP, Mente provided the father with all requested records in its possession. A copy of the RA and CAP may be found at:  https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/mente-ra-cap/index.html

OCR’s guidance on the HIPAA right of access is available at:  https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html.

OCR’s guidance on the HIPAA Privacy Rile and personal representatives is available at:  https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/personal-representatives/index.html.

OCR is committed to enforcing the privacy and security of peoples’ health information that is protected under HIPAA. If you believe that your or another person’s health information privacy or civil rights have been violated, you can file a complaint with OCR at:  https://www.hhs.gov/ocr/complaints/index.html.