HHS Office for Civil Rights Imposes a $200,000 Penalty Against Oregon Health & Science University for Failure to Provide Timely Access to Patient Records

The civil monetary penalty marks OCR’s 53rd HIPAA Right of Access enforcement action to advance patient access to medical records.

Today, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), announced a $200,000 civil monetary penalty against Oregon Health & Science University (OHSU), a public academic health center and research university, for violating an individual’s right to timely access her medical records through a personal representative.

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule’s “Right of Access” provisions require that individuals or their personal representatives have timely access to health information requested from a HIPAA covered entity (health plans and most health care providers) within 30 days, with the possibility of one 30-day extension and for a reasonable, cost-based fee. OCR enforces the HIPAA Privacy Rule, which establishes national standards to protect individuals’ medical records; sets limits and conditions on the uses and disclosures of protected health information; and gives individuals certain rights, including the right to timely access and to obtain a copy of their health records.

“The HIPAA Privacy Rule requires that individuals and their personal representatives receive timely access to their medical records,” said OCR Acting Director Anthony Archeval. “A covered entity’s responsibility to provide timely access continues, even when a covered entity contracts with a business associate to respond to HIPAA right of access requests.”

OCR initiated an investigation of OHSU based on a complaint filed in January 2021 from the individual’s personal representative – the second complaint OCR received on this matter. In September 2020, OCR resolved the first complaint (received in May 2020) when OCR notified OHSU of its potential noncompliance with the Privacy Rule Right of Access provisions. Although OHSU provided part of the requested records in April 2019, OHSU did not provide all of the requested records until August 2021, which was nearly a year after OHSU received OCR’s September 2020 letter, and sixteen months after the first request for records in April 2019. OCR’s investigation found that OHSU failed to take timely action in response to the right of access requests.

In September 2024, OCR issued a Notice of Proposed Determination seeking to impose a $200,000 civil monetary penalty. OHSU waived its right to a hearing and did not contest OCR’s imposition of a civil monetary penalty. Accordingly, in December 2024, OCR finalized its determination and imposed the $200,000 civil monetary penalty against OHSU.

The Notice of Proposed Determination may be found at: https://www.hhs.gov/sites/default/files/oregon-health-science-university-npd.pdf.

The Notice of Final Determination may be found at: https://www.hhs.gov/sites/default/files/oregon-health-science-university-nfd.pdf.

OCR is committed to enforcing the HIPAA Rules that protect the privacy and security of peoples’ health information. Guidance about the Privacy Rule, Security Rule, and Breach Notification Rule can also be found on OCR’s website.

If you believe that your or another person’s health information privacy or civil rights have been violated, you can file a complaint with OCR at: https://www.hhs.gov/ocr/complaints/index.html.

Follow HHS OCR on X (formerly Twitter) at @HHSOCR.