Electronic Healthcare Records , Governance & Risk Management , HIPAA/HITECH

HHS OCR Issues Another 'Right of Access' Settlement

Agreement With Queens Doctor Is Part of Agency's Ongoing HIPAA Records Access Initiative
HHS OCR Issues Another 'Right of Access' Settlement

Federal regulators Thursday issued their 11th HIPAA settlement – the ninth in recent months - involving a patient right of access to records case. The resolution agreement with a Queens, New York, physician’s practice calls for a $15,000 penalty and adoption of a corrective action plan.

See Also: OnDemand | Making the Connection Between Cybersecurity and Patient Care

In a statement, the Department of Health and Human Services’ Office for Civil Rights says that in September 2018, it received a complaint alleging that Rajendra Bhayani, M.D., an ear, nose and throat specialist, failed to provide a patient with access to her medical records following her request in July 2018.

”OCR responded by providing Dr. Bhayani with technical assistance on complying with HIPAA’s Right of Access requirements and closed the complaint. In July 2019, however, OCR received a second complaint alleging that Dr. Bhayani still had not provided the complainant with access to her records,” the statement says.

As a result of OCR’s investigation into the matter, the patient eventually received a complete copy of her medical records in September.

“Doctor’s offices, large and small, must provide patients their medical records in a timely fashion,” said Roger Severino, OCR director in the HHS statement. ”We will continue to prioritize HIPAA right of access cases for enforcement until providers get the message.

Corrective Actions

Under the resolution agreement with Bhayani, his practice will undertake a corrective action plan that includes:

  • Reviewing and revising policies and procedures for individual access to protected health information;
  • Providing privacy training on individual access to PHI to his workforce;
  • Submitting to HHS for two years a list of requests for access to PHI received by the practice, including the date the requests were received and the date the records were provided.

Bhayani’s practice did not immediately respond to an Information Security Media Group request for comment on the settlement.

Other Settlements

Last week, HHS OCR announced a $25,000 settlement in a patient right of access case involving Riverside Psychiatric Medical Group, a group practice in Riverside, California, specializing in child and adolescent mental healthcare.

The agreement with Bhayani, is the 16th HIPAA settlement of any type announced by OCR so far this year. Those HIPAA settlements included a total of more than $13.4 million in penalties.

The largest of OCR's HIPAA enforcement actions so far this year was a $6.8 million settlement announced in September with Premera Blue Cross in a case involving a 2014 breach that exposed information on 10.4 million individuals.

About the Author

Marianne Kolbasuk McGee

Marianne Kolbasuk McGee

Executive Editor, HealthcareInfoSecurity, ISMG

McGee is executive editor of Information Security Media Group's HealthcareInfoSecurity.com media site. She has about 30 years of IT journalism experience, with a focus on healthcare information technology issues for more than 15 years. Before joining ISMG in 2012, she was a reporter at InformationWeek magazine and news site and played a lead role in the launch of InformationWeek's healthcare IT media site.

Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing healthcareinfosecurity.com, you agree to our use of cookies.