American Medical Response (AMR), a private ambulance provider, paid $115,200 to the HHS’ Office for Civil Rights (OCR) as a civil monetary penalty to take care of the violation of the HIPAA Right of Access. AMR was unable to give a patient prompt access to their health records. It took over a year to give the requested information.
The HIPAA Right of Access is a clause under the HIPAA Privacy Rule and protects patients’ rights to get a copy of their health records, upon request, within 30 days of requesting a copy. In selected instances, the duration can be extended for 30 days. The fine concerns the HIPAA-covered entity American Medical Response Ambulance Service, which is a subsidiary of American Medical Response.
On October 31, 2018, the impacted party requested a copy of her medical records by faxing a written request to AMR. The request included all billing details and health records associated with an injury treatment received on September 15, 2015, and patient balance confirmation. She asked for those data to be available in electronic format. The requesting party should have received the data by November 30, 2018.
The affected party sent follow-up requests on January 24, 2019 to the Los Angeles office of AMR and Centrex, its business associate. AMR delivered the request on March 1, 2019, which is 121 days after submitting the initial request. AMR responded with an invoice demanding payment before releasing the records. On March 18, 2019, the impacted party followed up AMR asking for the records or it would file a complaint with OCR. A complaint was submitted to OCR on July 29, 2019. The records were eventually given to the requesting party on November 5, 2019 after 370 days of making the initial request.
OCR’s investigation confirmed that there was a HIPAA Right of Access violation. AMR was given the chance to resolve the case. AMR’s lawyer questioned OCR to reevaluate its position but did not give any counteroffer or make negotiations. OCR mailed a letter of opportunity to AMR to tell it to submit written proof of mitigating steps, but OCR reported that AMR’s reasons didn’t boost an affirmative defense for the waiver of the civil monetary penalty.
This is OCR’s 47th financial penalty to be issued to settle a HIPAA Right of Access violation. The HIPAA violation penalty tier was reasonable cause, with the penalty amount computed on every day between December 1, 2018 and February 28, 2019. AMR had guidelines and procedures set up for handling requests from people for copies of their health records and has currently modified those guidelines and procedures to make sure they are better managed.
HIPAA requires covered entities to give patients timely access to their health records. OCR is committed to implementing this right investigating, and imposing civil money penalties when necessary.
