Content created by Office for Civil Rights (OCR)
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Departmental Appeals Board
Civil Remedies Division
OFFICE FOR CIVIL RIGHTS,
Petitioner,
v.
SOUTH BROWARD HOSPITAL DISTRICT
d/b/a MEMORIAL HEALTHCARE SYSTEM,
Respondent.
Docket No. C-25-50
SETTLEMENT AGREEMENT
This Settlement Agreement (“Agreement”) is entered into between the United States Department of Health and Human Services, Office for Civil Rights (“OCR”) and South Broward Hospital District d/b/a Memorial Healthcare System (“MHS”) (collectively, “the Parties”), acting through their duly authorized representatives, to resolve this case prior to an administrative hearing pursuant to 45 C.F.R. § 160.514.
I. RELEVANT BACKGROUND
- OCR enforces the Federal standards that govern the privacy of individually identifiable health information (45 C.F.R. Part 160 and Subparts A and E of Part 164, the “Privacy Rule”), the Federal standards that govern the security of electronic individually identifiable health information (45 C.F.R. Part 160 and Subparts A and C of Part 164, the “Security Rule”), and the Federal standards for notification in the case of breach of unsecured protected health information (45 C.F.R. Part 160 and Subparts A and D of 45 C.F.R. Part 164, the “Breach Notification Rule”). OCR has the authority to conduct compliance reviews and investigations of complaints alleging violations of the Privacy, Security, and Breach Notification Rules (collectively the “HIPAA Rules”) by covered entities and business associates, and covered entities and business associates must cooperate with OCR compliance reviews and complaint investigations. See 45 C.F.R. §§ 160.306(c), 160.308, and 160.310(b).
- MHS is a “covered entity” under 45 C.F.R. § 160.103 and therefore is required to comply with the HIPAA Rules.
- Under the HIPAA Privacy Rule, an individual has a right of access to inspect and obtain a copy of protected health information (“PHI”) about the individual in a designated record set for as long as the PHI is maintained by a covered entity in the designated record set. 45 C.F.R. § 164.524(a). A covered entity must act on a request for access no later than 30 days after receipt of the request. 45 C.F.R. § 164.524(b).
- On June 23, 2021, HHS received a complaint against MHS from a patient (“Complainant”). The Complainant alleged that he requested specific medical records from MHS on April 26, 2021, and had not received them by the date of his complaint.
- OCR’s investigation revealed that the Complainant requested his PHI, specifically an EEG tracing, via MHS’s patient portal on December 30, 2020, and again on April 25, 2021. The Complainant also sent a request for a copy of the same records via U.S. Postal Service on April 26, 2021. The Complainant made a follow-up request on May 23, 2021, via the patient portal. The Complainant did not receive the EEG tracing until September 29, 2021, after OCR initiated its investigation of MHS. MHS had previously provided the Complainant with the requested EEG tracing on one prior occasion, but MHS did not respond to the Complainant’s December 30, 2020 request or follow-up requests.
- By letter dated November 10, 2022, OCR notified MHS that OCR found preliminary indications of noncompliance with the Privacy Rule’s right of access standard (45 C.F.R. § 164.524(b)) requiring a covered entity to act on a request for access to PHI no later than 30 days after receipt of the request. The letter additionally notified MHS of the opportunity to submit for OCR’s consideration written evidence of any mitigating factors, affirmative defenses, or to support a waiver of a civil money penalty (“CMP”). MHS responded to the letter by email dated December 8, 2022.
- By letter dated July 17, 2024, OCR notified MHS that OCR was proposing to impose a CMP in the amount of $100,000 for failing to comply with the right of access standard at 45 C.F.R. § 164.524(b).
- On October 11, 2024, MHS requested a hearing before an Administrative Law Judge to contest OCR’s imposition of the CMP and the matter was docketed before the Civil Remedies Division of the Departmental Appeals Board (“DAB”) of the United States Department of Health and Human Services as Docket No. C-25-50.
II. SETTLEMENT TERMS AND CONDITIONS
Respondent and OCR have engaged in settlement negotiations and agreed to resolve this case prior to an administrative hearing. In consideration of the mutual understanding in settlement of this matter and subject only to the conditions contained herein, the Parties agree as follows:
- MHS agrees to pay, and OCR agrees to accept, the amount of $ $60,000 (“Settlement Amount”). MHS agrees to pay the Settlement Amount within two (2) business days of the Effective Date pursuant to written instructions to be provided by OCR.
- MHS agrees to withdraw its request for a hearing in the case docketed as DAB Docket No. C-25-50, and within three (3) business days of the Effective Date will so notify the DAB by withdrawing its request for a hearing pursuant to 45 C.F.R. § 160.504(d).
- The Parties are entering into this Agreement in the interest of avoiding the time and cost of litigation. Nothing in this Agreement should be construed as an admission of any wrongdoing or liability or a concession of the positions taken by either party.
- The Agreement shall become effective (i.e., final and binding) upon the date of signing of this Agreement by the last signatory (Effective Date).
- This Agreement is binding on MHS and its successors, heirs, transferees, and assigns.
- Each Party to this Agreement shall bear its own legal and other costs incurred in connection with this matter, including the preparation and performance of this Agreement.
- This Agreement is exclusively intended to settle this case prior to a hearing before the DAB and does not constitute a waiver of any other rights or remedies available to OCR or to MHS.
- OCR does not release MHS from, nor waive any rights, obligations, or causes of action other than those arising out of or related to this Agreement. This release does not extend to actions that may be brought under Section 1177 of the Social Security Act, 42 U.S.C. § 1320d-6.
- This Agreement is intended to be for the benefit of the Parties only and by this instrument the Parties do not release any claims against or by any other person or entity.
- This Agreement constitutes the complete agreement between the Parties. All material representations, understandings, and promises of the Parties are contained in this Agreement. Any modifications to this Agreement shall be set forth in writing and signed by all Parties.
- OCR places no restriction on the publication of the Agreement. OCR may be required to disclose material related to this Agreement to any person upon request consistent with the applicable provisions of the Freedom of Information Act, 5 U.S.C. § 552, and its implementing regulations, 45 C.F.R. Part 5.
- This Agreement may be executed in counterparts, each of which constitutes an original, and all of which shall constitute one and the same agreement. Electronic or PDF signatures will be valid and enforceable in lieu of handwritten signatures.
- The individual(s) signing this Agreement on behalf of MHS represents and warrants that they are authorized to execute this Agreement and bind MHS. The individual(s) signing this Agreement on behalf of OCR represents and warrants that they are signing this Agreement in their official capacity and that they are authorized to execute this Agreement.
FOR RESPONDENT South Broward Hospital District d/b/a Memorial Healthcare System
/s/
Sarah P. Griffith
Deputy General Counsel
Memorial Healthcare System
Dated: 12/11/2024
FOR U.S. Department of Health and Human Services, Office for Civil Rights
/s/
Susan M. Pezzullo Rhodes
Regional Manager, New England Region
Office for Civil Rights
Dated: 12/11/2024