American Medical Response Notice of Proposed Determination

October 3, 2023

Ted Van Horne, Chief Executive Officer
American Medical Response
6363 South Fiddlers Green Circle 
Greenwood Village, Colorado  80111

VIA PERSONAL SERVICE TO Registered Agent:
Corporation Service Company
American Medical Response 
1900 West Littleton Boulevard 
Littleton, Colorado  80120

VIA EMAIL TO Legal Counsel:
David Gacioch
McDermott Will & Emery LLP
200 Clarendon Street
Boston, Massachusetts  02116
dgacioch@mwe.com

Re:    American Medical Response
OCR Transaction Number: 19-353058

Notice of Proposed Determination

Dear Ted Van Horne
Registered Agent:
David Gacioch:

Pursuant to the authority delegated by the Secretary of the U.S. Department of Health and Human Services (HHS) to the Office for Civil Rights (OCR), I am writing to inform you that OCR is proposing to impose a civil money penalty (CMP) of $115,200 against American Medical Response (AMR).

This proposed action is being taken under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), § 262(a), Public Law 104-191, 110 Stat. 1936, as amended by the Health Information Technology for Economic

and Clinical Health (HITECH) Act, Public Law 111-5, Section 13410, codified at 42 United States Code (U.S.C.) § 1320d-5, and under 45 C.F.R. Part 160, Subpart D.

I.     The Statutory Basis for the Proposed CMP

The Secretary of HHS is authorized to impose a CMP (subject to the limitations set forth at 42 U.S.C. § 1320d-5(b)) against any covered entity, as described at 42 U.S.C. § 1320d-1(a), that violates a provision of Part C (Administrative Simplification) of Title XI of the Social Security Act. See HIPAA, § 262(a), as amended, 42 U.S.C. § 1320d-5(a). This authority includes imposing CMPs for violations of the applicable provisions of the Federal Standards for Privacy of Individually Identifiable Health Information and the Security Standards for the Protection of Electronic Protected Health Information (45 Code of Federal Regulations (C.F.R.) Parts 160 and 164, Subparts A, C, and E, the Privacy and Security Rules), and the Breach Notification Rule (45 C.F.R. Parts 160 and 164, Subpart D). The Secretary has delegated enforcement responsibility for the HIPAA Rules to the Director of OCR. See 65 Federal Register (Fed. Reg.) 82381 (Dec. 28, 2000) and 74 Fed. Reg. 38630 (July 27, 2009). OCR is authorized under the HITECH Act § 13410, 42 U.S.C. § 1320d-5(a)(3),1 to impose CMPs for violations occurring on or after February 18, 2009,2 of:

  • A minimum of $100 for each violation where the covered entity or business associate did not know and, by exercising reasonable diligence, would not have known that the covered entity or business associate violated such provision, except that the total amount imposed on the covered entity or business associate for all violations of an identical requirement or prohibition during a calendar year may not exceed $25,000.

  • A minimum of $1,000 for each violation due to reasonable cause and not to willful neglect, except that the total amount imposed on the covered entity or business associate for all violations of an identical

    requirement or prohibition during a calendar year may not exceed $100,000. Reasonable cause means an act or omission in which a covered entity or business associate knew, or by exercising reasonable diligence would have known, that the act or omission violated an administrative simplification provision, but in which the covered entity or business associate did not act with willful neglect.

  • A minimum of $10,000 for each violation due to willful neglect and corrected within 30 days, except that the total amount imposed on the covered entity or business associate for all violations of an identical requirement or prohibition during a calendar year may not exceed $250,000.
  • A minimum of $50,000 for each violation due to willful neglect and uncorrected within 30 days, except that the total amount imposed on the covered entity or business associate for all violations of an identical requirement or prohibition during a calendar year may not exceed $1,500,000.

As required by law, OCR has adjusted the CMP ranges for each penalty tier for inflation.3 The adjusted amounts are applicable only to CMPs whose violations occurred after November 2, 2015.

OCR is precluded from imposing a CMP unless the action is commenced within six years from the date of the violation.4

II.    Findings of Fact

  1. American Medical Response Ambulance Service, Inc. is a wholly owned subsidiary of American Medical Response, Inc. Corporately, American Medical Response, Inc., is wholly owned by AMR Holdco, Inc., which is wholly owned by Global Medical Response, Inc.
  2. AMR is a “covered entity” within the meaning of 45 C.F.R. § 160.103, and, as such, is required to comply with the requirements of the Privacy, Security, and Breach Notification Rules.
  3. AMR is a health care provider that transmits health information in electronic form in connection with transactions for which the U.S Department of Health and Human Services has adopted standards.
  4. AMR creates, maintains, receives, and transmits protected health information (PHI) related to patients for whom AMR provides medical care and medical transport services.
  5. The Affected Party (AP) received medical and transport services from AMR.
  6. Complainant is the AP’s attorney and filed on behalf of the AP the complaint that is the subject of these proceedings.
  7. Under the HIPAA Privacy Rule, an individual has a right of access to inspect and obtain a copy of PHI about the individual in a designated record set5 for as long as the PHI is maintained by a covered entity in the designated record set.6 An individual also has a right to direct an electronic copy of PHI in an electronic health record (EHR) to a third party in an electronic format.7
  8. On October 31, 2018, the AP sent a request via fax to AMR asking that a copy of her medical records including, “all billing records pertaining to treatment rendered for 9/15/2015 injury date; Patient Balance Verification; all medical records pertaining to treatment rendered for 9/15/2015 injury date” be sent in electronic format to the Complainant (“access request”).
  9. The AP’s access request was submitted to AMR via (206) 444-4599.  AMR admitted that this number transmits faxes to AMR’s Seattle office.
  10. The AP’s access request was in writing, signed by the AP, and clearly identified Complainant and where to send the copy of the AP’s PHI.
  11. The AP received a fax transmission report reflecting that AMR received her request on October 31, 2018.
  12. AMR uses an electronic health record (EHR) for its medical records, and it maintained the AP’s requested PHI in its EHR.
  13. A covered entity must act on a request for access no later than 30 days after receipt of the request.8
  14. A covered entity can respond to a right of access request by granting or denying the request in whole or in part, or if it is unable to take an action required, it may extend the timeframe for responding by an additional 30 days by sending the requestor a written statement of the reasons for the delay and the date by which the covered entity will complete its action on the request. 45 C.F.R. § 164.524(b)(2).
  15. The Privacy Rule required AMR to act on the AP’s request on or before November 30, 2018.
  16. On November 8, 2018, the AP mailed a copy of her October 31, 2018, access request to AMR’s Seattle, Washington office via certified mail to an address that AMR does not dispute belongs to AMR’s Seattle office. The AP received confirmation from the United States Postal Service that the access request was successfully delivered on November 13, 2018.
  17. On January 24, 2019, the AP sent two follow-up access requests.  One access request was sent to AMR’s Los Angeles office via certified mail and the other was sent to Centrex, AMR’s Business Associate (BA), via a fax number belonging to the BA. The AP received confirmation that her fax transmission was successful.
  18. AMR and its BA received the AP’s January 24, 2019, access requests.
  19. AMR did not respond to the AP’s request until March 1, 2019, 121 days after the initial request, when AMR sent the AP an invoice requiring payment before AMR would provide the requested records to Complainant.
  20. On March 18, 2019, Complainant sent AMR a follow-up letter in which Complainant reiterated the AP’s multiple access requests and advised AMR that if the AP’s PHI was not sent to Complainant in an electronic format, as requested by the AP, within seven days, Complainant would file a complaint with OCR.
  21. On July 29, 2019, Complainant filed a complaint with OCR alleging that AMR did not provide Complainant with a copy of the AP’s PHI in response to the AP’s multiple access requests.
  22. OCR notified AMR in writing of the complaint and its intent to investigate the matter and issued a data request on October 9, 2019. OCR requested data including a copy of AMR’s HIPAA policies and procedures regarding access to PHI.
  23. At the time of the AP’s initial request for access, AMR had procedures in place for processing individuals’ written access requests, including requests submitted directly to an AMR office.
  24. AMR procedures for individuals submitting access requests to AMR’s Seattle office, as the AP did, was for AMR’s Seattle office to transmit requests to AMR’s office in Los Angeles, California; then, for AMR’s Los Angeles office to transmit the requests to Centrex, AMR’s then-BA, for processing.
  25. In response to OCR’s investigation, AMR amended its internal procedures to streamline and better track access requests.
  26. In response to OCR’s investigation, AMR sent the AP’s records to Complainant on November 5, 2019, which was 370 days after the AP’s initial request.
  27. OCR notified AMR of the results of OCR’s investigation on August 3, 2021, and offered AMR an opportunity to resolve the matter informally.
  28. AMR responded to OCR through counsel on August 9, 2021, asking OCR to “reconsider its position.”
  29. AMR did not provide a counteroffer or otherwise engage in negotiations with OCR.
  30. OCR sent a Letter of Opportunity (LOO) to AMR on April 15, 2022.
  31. The LOO informed AMR that OCR’s investigation indicated that AMR failed to comply with the Privacy Rule, specifically 45 C.F.R. § 164.524(b). The LOO stated that pursuant to 45 C.F.R. § 160.312(a)(3), OCR was informing AMR of the preliminary indications of noncompliance and providing AMR with an opportunity to submit written evidence of mitigating factors under 45 C.F.R. § 160.408 or affirmative defenses under 45 C.F.R. § 160.410 for OCR’s consideration in making a determination of a CMP pursuant to 45 C.F.R. § 160.404. The letter stated that AMR could also submit written evidence to support a waiver of a CMP for the indicated areas of noncompliance pursuant to 45 C.F.R. § 160.412. Each act of noncompliance under the Privacy Rule was described in the letter.
  32. AMR responded to the LOO by letter dated May 16, 2022.
  33. OCR determined that the information and arguments submitted by AMR do not support an affirmative defense pursuant to 45 C.F.R. § 160.410. See Section IV below.
  34. OCR considered factors pursuant to 45 C.F.R. § 160.408, including AMR’s LOO response alleging mitigating factors, and aggravating factors based on evidence obtained by OCR during its investigation, in determining the amount of the CMP. See Section V below.
  35. OCR determined that the information and arguments submitted by AMR do not support a waiver of the CMP pursuant to 45 C.F.R. § 160.412. See Section VI below.
  36. OCR obtained the authorization of the Attorney General of the United States prior to issuing this Notice of Proposed Determination to impose a CMP.

III.  Basis for CMP

Based on the above findings of fact, OCR has determined that AMR is liable for the following violation of the HIPAA Rules and, therefore, subject to a CMP.

AMR failed to provide the AP timely access to her PHI, after receiving her lawful requests, in violation of the Privacy Rule at 45 C.F.R. § 164.524(b). The appropriate penalty tier for this violation from December 1, 2018, to February 28, 2019, is Reasonable Cause, as follows:

Calendar Year 2018: 31 days from December 1, 2018, to December 31, 2018, at $1,280 per day (CMP of $39,680)

Calendar Year 2019: 59 days from January 1, 2019, to February 28, 2019, at $1,280 per day (CMP of $75,520)

Total CMP: $115,200

IV.  No Affirmative Defenses

By its April 15, 2022, LOO, OCR offered AMR the opportunity to provide written evidence of affirmative defenses per 45 C.F.R. § 160.410. AMR responded by letter dated May 16, 2022. OCR determined that the information contained in AMR’s response did not provide a basis for an affirmative defense under 45 C.F.R. § 160.410.

AMR asserted that HIPAA’s affirmative defense bars any CMP, as a matter of law, because any violation was not due to willful neglect and was timely corrected.

AMR did not timely correct the violation in this matter. 9 The AP sent a valid right of access request to AMR’s Seattle office on October 31, 2018, and again on November 8, 2018. AMR failed to take timely action after it received these requests for medical records and subsequent follow-up requests to AMR for the same medical records, and failed to provide the requested records until November 5, 2019, well over a year after the AP’s initial request.

V.   Factors Considered in Determining the Amount of the CMP

In its May 16, 2022, letter to OCR responding to the LOO, AMR asserted that the factors set forth in 45 C.F.R. § 160.408 counsel against any significant CMP in this matter. In accordance with § 160.408, OCR considered AMR’s response and the evidence obtained during its investigation in determining the amount of the CMP. OCR considered the factors as follows:

  1. The nature and extent of the violation.

    The AP submitted multiple written requests for access that AMR failed to act upon by either providing access or sending a denial letter. AMR did not act on the AP’s request for access until four months after the date of the access request. AMR did not provide Complainant with the requested records until more than twelve months after the date of the access request.

    AMR asserted that the violation at issue relates to only a single individual’s request for records and the violation occurred over a short period of time.

    Although the violation affected only one individual, OCR determined that AMR did not fulfill the AP’s initial access request until November 5, 2019, 370 days after it was made. Additionally, OCR’s investigation revealed that the AP submitted multiple written requests for access that AMR failed to respond pursuant to the requirements of 45 C.F.R. §164.524 by either providing access or sending a denial letter.
    As such, OCR finds this is a neutral factor, with mitigating and aggravating considerations canceling each other out.

  2. The nature and extent of the harm resulting from the violation.

    AMR asserted that no harm resulted from the violation, and it did not hinder the AP’s ability to obtain health care or have any impact on her litigation.

    During its investigation, OCR reviewed evidence that AMR’s failure to timely provide Complainant with the AP’s PHI may have impacted the AP’s litigation and caused the AP financial harm. The AP accepted a settlement that may have been less than what she was otherwise entitled to recover because Complainant could not prove the full extent of the AP’s damages without the PHI related to the AP’s accident, her immediately apparent injuries, and the AMR first responder’s record.

    To avoid engaging in speculation and to remain impartial, OCR finds that this is neither an aggravating nor mitigating factor.

  3. The history of prior compliance with the administrative simplification provisions, including violations.

    Since 2017, OCR has received multiple right of access complaints against AMR. Seven of those complaints were closed administratively

    without investigation, thus the allegations were not substantiated.  However, OCR resolved five of those complaints with technical assistance.10

    This factor requires that OCR analyze how the covered entity has responded to technical assistance from the Secretary provided in the context of a compliance effort. OCR’s findings in this case shows that AMR did not take adequate corrective action in response to OCR’s prior provision of technical assistance.

    However, as OCR has not previously investigated a right of access complaint against AMR, it does not have sufficient information to determine previous indications of AMR’s noncompliance with the right of access provision. OCR also does not have sufficient information to determine whether and to what extent the covered entity has attempted to correct previous indications of noncompliance or how the covered entity has responded to prior complaints.

    As such, OCR finds this is a neutral factor, with mitigating and aggravating considerations canceling each other out.

  4. The financial condition of the covered entity.

    AMR’s website states that it is part of the largest medical transport company in the world, with AMR ground ambulances providing service across the United States. AMR also has a domestic and international Air Ambulance division. On its consolidated balance sheet, AMR reported its assets as $106,361,000 for December 2018, and $114,788,000 for September 2019. On its consolidated statement of operations, AMR reported its net revenue as $347,801,000 as of December 31, 2018, and $301,933,000 as of September 30, 2019.

    OCR’s investigation did not reveal any evidence that AMR was experiencing any financial difficulties that would affect its ability to comply with HIPAA or that would jeopardize its ability to continue to provide health care. Evidence obtained by OCR shows that AMR has financial resources available to maintain compliance (e.g., regularly review and update policies and procedures for consistency, and to train staff). Furthermore, AMR is a large entity and the imposition of

    the proposed CMP will not negatively interfere with its provision of services. In addition, AMR did not seek leniency based on any financial hardship.

    OCR considered the evidence obtained during its investigation and weighted this factor as neither mitigating nor aggravating.

  5. Such other matters as justice may require.

    OCR has not identified other matters as justice may require in its consideration of aggravating or mitigating factors. As such, OCR finds this is neither a mitigating nor aggravating factor.

    OCR did not identify any aggravating factors such that merit calculating CMPs for the potential violations at a daily amount higher than the minimum under reasonable cause.11

    AMR argued that OCR should exercise its discretion and choose not to apply any CMPs because of “multiple mitigating factors” under 45 C.F.R. § 160.408. OCR notes that AMR raised factually inaccurate mitigating factor arguments, including that the violation was timely corrected. OCR considered AMR’s purported mitigating factors and determined that the CMP calculation need not be mitigated or aggravated but that it remain at $115,000.

Therefore, based on OCR’s evaluation of all factors,12 OCR has determined that a CMP at the reasonable cause level is warranted in this matter, as detailed in Section III above and Section VII below.

V.   Waiver

By its April 15, 2022, LOO, OCR offered AMR the opportunity to provide written evidence supporting waiver of the proposed CMP amount. AMR, through legal counsel, responded by letter dated May 16, 2022. OCR determined that the information contained in AMR’s response did not provide a basis for waiver of the proposed CMP amount pursuant to 45 C.F.R. § 160.412 because payment of the penalty is not excessive relative to the violation.

VII.  Amount of CMP

A.  Amount of CMP Per Violation

OCR finds that AMR is liable for a CMP for violating the following requirement of the Privacy Rule:

Timely Action by the Covered Entity – 45 C.F.R. § 164.524(b). The CMP amount is based on 45 C.F.R. § 160.404(b)(2)(ii)(A) [Reasonable Cause].

B.  Total Amount of CMP

The total CMP amount to be imposed on AMR with regard to the violation described is $115,200.

VIII.   Right to a Hearing

AMR has the right to a hearing before an administrative law judge to challenge the proposed CMP. To request a hearing to challenge the proposed CMP, AMR must mail a request, via certified mail with return receipt requested, under the procedures set forth at 45 C.F.R. Part 160 within 90 days of your receipt of this letter. Such a request must: (1) clearly and directly admit, deny, or explain each of the findings of fact contained in this notice; and (2) state the circumstances or arguments that you allege constitute the grounds for any defense, and the factual and legal basis for opposing the proposed CMP. See 45 C.F.R. § 160.504(c). If you wish to request a hearing, you must submit your request to:

U.S. Department of Health & Human Services
Departmental Appeals Board, MS 6132
Civil Remedies Division
330 Independence Ave, SW
Cohen Building, Room G-644
Washington, D.C.  20201
Telephone: (202) 565-9462

Copy to:
Emily Crabbe, Acting Senior Advisor 
Office for Civil Rights
U.S. Department of Health and Human Services
1961 Stout Street, Room 08-148
Denver, Colorado 80294

Telephone: (404) 562-7878

A failure to request a hearing within 90 days permits the imposition of the proposed CMP without a right to a hearing under 45 C.F.R. § 160.504 or a right of appeal under 45 C.F.R. § 160.548. If you choose not to contest this proposed CMP, you should submit a written statement accepting its imposition within 90 days of receipt of this notice.

If AMR does not request a hearing within 90 days, then OCR will notify AMR of the imposition of the CMP through a separate letter, including instructions on how to make payment, and the CMP will become final upon receipt of such notice.

If you have questions, you may contact Ms. Crabbe at (404) 562-7878 or via email at Emily.Crabbe@hhs.gov.

Sincerely,

Andrea Oliver
Regional Manager

Endnotes

1 The CMPs reflect the penalty tiers described in the Notification of Enforcement Discretion (April 30, 2019). See https://www.federalregister.gov/documents/2019/04/30/2019-08530/notification-of-enforcement-discretion-regarding-hipaa-civil-money-penalties.

2 For violations occurring on or after November 3, 2015, HHS may make annual adjustments to the CMP amounts pursuant to the Federal Civil Penalties Inflation Adjustment Act Improvement Act of 2015. The annual inflation amounts are found at 45 C.F.R. §102.3.

3 See Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015, Sec. 701 of Public Law 114-74.  Current inflation amounts are available at 45 CFR § 102.3.

4 See 42 U.S.C. § 1320a-7a(c)(1); 45 C.F.R. § 160.414.

5 Designated record set means: (1) A group of records maintained by or for a covered entity that is: (i) The medical records and billing records about individuals maintained by or for a covered health care provider; (ii) The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or (iii) Used, in whole or in part, by or for the covered entity to make decisions about individuals. (2) For purposes of this paragraph, the term record means any item, collection, or grouping of information that includes protected health information and is maintained, collected, used, or disseminated by or for a covered entity. 45 C.F.R §164.501.

6 45 C.F.R. § 164.524(a).

7 HITECH Act § 13405(e).

8 45 C.F.R. § 164.524(b)(2).

9 In order to be “timely corrected”, the violation needs to be corrected within 30 days beginning on the first date the covered entity knew, or by exercising reasonable diligence, would have known that the violation occurred.” 45 CFR 160.410(c).

10 See OCR Transactions: 19-341624 (resolved with technical assistance); 19-333252 (resolved with technical assistance); 19-332142 (resolved with technical assistance); 18-299516 (resolved with technical assistance); and 17-280321 (resolved with technical assistance).

11 See 45 C.F.R. § 160.404 (Amount of a civil money penalty) and also 87 Fed. Reg. 15109 (March 17, 2022).

12 OCR reserves the right to raise any defenses in response to its computation of the CMP amount or its evaluation of the § 164.408 factors should this become an issue at any future hearing.

Content created by Office for Civil Rights (OCR)
Content last reviewed