UnitedHealth pays $80,000 to settle HIPAA allegations
A patient requested his medical records and did not receive them for six months - after the OCR stepped in - agency says.
ftwitty/Getty Images
The Office for Civil Rights has announced a settlement with UnitedHealthcare over a potential violation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule's right of access provision.
The rule requires that patients be able to access their medical information in a timely manner.
UnitedHealth has agreed to implement a corrective action plan and pay $80,000 to resolve the investigation.
WHY THIS MATTERS: WHAT HAPPENED
In March 2021, OCR received a complaint alleging that UnitedHealthcare did not respond to an individual's request for a copy of their medical record, according to the Department of Health and Human Services.
The individual first requested a copy of their records on January 7, 2021, but did not receive the records until July 2021, after OCR initiated its investigation. This was the third complaint OCR received from the complainant against UnitedHealthcare alleging failures to respond to his right of access, HHS said.
OCR's investigation determined that the failure to provide timely access to the requested medical records was a potential violation of the HIPAA right of access provision.
In addition to the monetary settlement, UnitedHealth also agreed to implement a corrective action plan that includes one year of monitoring by OCR.
THE LARGER TREND
This investigation marks the 45th Right of Access case to be resolved via voluntary settlement, HHS said.
The Privacy Rule generally requires HIPAA covered entities (health plans and most healthcare providers) to provide individuals, upon request, access to their protected health information (PHI) contained in designated record sets.
Under OCR's guidance on the HIPAA right of access, individuals have the right to access their medical records and billing records from their provider. From their health plan, individuals have the right to access information on enrollment, payment, claims adjudication and case or medical management records used to make decisions about them.
The last category includes records about an individual whether or not they've been used to make a decision, HHS said.
ON THE RECORD
"Timely access to health information is one of the cornerstones of HIPAA. OCR will continue to ensure that covered entities with a record of delaying or denying access requests will be subject to enforcement," said OCR Director Melanie Fontes Rainer. "Health insurers are not exempt from the right of access and must ensure that they are taking steps to train their workforce to ensure that they are doing all they can to help members' access to health information."
Twitter: @SusanJMorse
Email the writer: SMorse@himss.org
