In a first of its kind enforcement action, the Office of Civil Rights at the Department of Health and Human Services (“HHS”) entered into a resolution agreement with Florida-based Bayfront HMA Medical Center, LLC (“Bayfront”) pursuant to its Right of Access Initiative for failing to provide timely access to a patient’s protected health information.
Bayfront is a Level II trauma and tertiary care center licensed as a 480-bed hospital with over 550 affiliated physicians. Bayfront has agreed to pay HHS $85,000 to resolve the issue and has entered into a corrective action plan that will last one year. Pursuant to the corrective action plan, Bayfront must update its policies and procedures regarding a patient’s right to access their protected health information and have all members of its workforce and business associates certify that they will abide by the updated policies. HHS’ Right of Access Initiative aims to put individuals “in the driver’s seat” to help move toward a more patient-centered health care system.
Bayfront failed to provide a mother with timely access to fetal heart monitor records about her unborn child. Bayfront responded that it could not find the records. The patient then had a lawyer request the records from Bayfront on two separate occasions, and Bayfront failed to provide a complete response to the lawyer until seven months after the lawyer’s initial request was made. The government initiated its investigation of Bayfront after receiving a complaint from the mother about the lack of access to the records. As a result, Bayfront finally provided the mother with the requested health information more than nine months after her initial request.
HIPAA generally requires covered health care providers to provide medical records within 30 days of the request, and providers can only charge a reasonable cost-based fee for the records. This right to patient records extends to parents who seek medical information about their minor children, and in this case, to a mother who sought prenatal health records about her child.
Health care providers need to be aware of this enforcement action within the context of HHS’ Right of Access Initiative. They also need to understand when and how access to medical records must be provided under HIPAA. A good place to start understanding the right of access is the HHS webpage dedicated to addressing the issue. Also, certain categories of information are expressly excluded from the right of access, such as psychotherapy notes and information compiled in anticipation of a civil, criminal or administrative action or proceeding. Based on HHS’ Right of Access Initiative, other providers likely will be investigated in the near future for issues similar to the one involving Bayfront.
Our Frost Brown Todd health care team understands the nuances of HIPAA and its interaction with various state law privacy issues. We regularly counsel large health systems and individual providers on their privacy obligations to help ensure compliance and patient satisfaction. Further, we have also developed an extremely user-friendly HIPAA manual that our clients have put into place to help them confidently address health privacy issues on their own.