Children's Hospital & Medical Center in Nebraska pays $80,000 to settle HIPAA complaint
This is the 20th investigation of HIPAA Right to Access by the Office of Civil Rights.
Photo: ftwitty/Getty Images
Children's Hospital & Medical Center in Omaha, Nebraska is paying $80,000 to settle a potential violation of the HIPAA privacy law on a complaint that the hospital did not provide timely access to all of the medical records requested.
In May 2020, a parent filed a complaint with the Office of Civil Rights alleging that CHMC had failed to provide her with timely access to her minor daughter's medical records. CHMC provided some records, but did not provide all of the requested records in response to the parent's multiple follow-up requests, according to the Department of Health and Human Services' Office of Public Affairs.
OCR initiated an investigation and determined that CHMC's failure to provide timely access to the requested medical records was a potential violation of the HIPAA right of access standard, which requires a covered entity to take action on an access request within 30 days of receipt (or within 60 days if an extension is applicable).
The parent asked for the information on January 3, 2020, and CHMC provided a portion of the requested records, according to HHS. The remainder needed to be collected from another CHMC division. The remaining records were provided on June 20, 2020 and July 16, 2020.
OCR said the parent finally received all of the requested records as a result of its investigation.
WHY THIS MATTERS
Enforcement of the Health Insurance Portability and Accountability Act, which was signed into law in 1996, gives patients both protection over who can see their medical information and access to their own records.
Children's Hospital & Medical Center admitted no liability in the resolution agreement announced on Friday, but the settlement proved costly. In addition to paying $80,000, CHMC has agreed to undertake a corrective action plan that includes one year of monitoring.
THE LARGER TREND
This is OCR's 20th investigation of HIPAA Right of Access.
OCR said it created this initiative to support individuals' right to timely access their health records at a reasonable cost under the HIPAA Privacy Rule.
ON THE RECORD
"Generally, HIPAA requires covered entities to give parents timely access to their minor children's medical records, when the parent is the child's personal representative. OCR's Right of Access Initiative supports patients' and personal representatives' fundamental right to their health information and underscores the importance of all covered entities' compliance with this essential right," said Acting OCR Director Robinsue Frohboese.
Twitter: @SusanJMorse
Email the writer: susan.morse@himssmedia.com
