Feds Advantageous Psychological Well being Clinic $100K in 2020 HIPAA Case

Federal regulators have fined a Los Angeles county mental health clinic $100,000 for failure to provide a patient with timely access to her requested health records. The patient’s initial request came on the eve of California’s COVID-19 pandemic lockdown.

See Also: How Overreliance on EDR is Failing Healthcare Providers

The case in opposition to Rio Hondo Group Psychological Well being Middle – which is operated by the Los Angeles County Division of Psychological Well being – is the U.S. Division of Well being and Human Companies’ Workplace for Civil Rights’ 51st enforcement motion in a dispute involving the HIPAA right-of-access provision.

HHS OCR launched its right of access initiative as a prime HIPAA enforcement precedence in Apr. 2019, throughout Donald Trump’s first presidential administration.

“This newest settlement underscores that HHS OCR is taking HIPAA and affected person rights severely,” stated regulatory lawyer Rachel Rose, who will not be concerned within the Rio Hondo case.

“A manner to make sure compliance is to include HIPAA privateness rule necessities into the annual threat evaluation and proper any gaps. Additionally, taking a look at acceptable and compliant enterprise associates is one other option to have the affected person get their information in a well timed method,” she stated.

HHS OCR in an announcement Tuesday stated the case in opposition to Rio Hondo centered on a grievance from a affected person in Aug. 2020, alleging the psychological well being clinic had not supplied her along with her medical information after a number of requests in writing, in individual and by telephone.

The affected person made her preliminary request in individual at Rio Hondo on Mar. 18, 2020, by finishing a paper medical information request kind.

The following day, on Mar. 19, 2020, California Governor Gavin Newsom issued a “stay-at-home” order geared toward slowing the unfold of COVID-19. From that day, till someday in Could 2020, Rio Hondo weren’t bodily working on the facility.

After subsequent visits and a number of telephone calls to Rio Hondo over seven months, the clinic lastly supplied the affected person along with her requested medical information in Oct. 2020 – after HHS OCR had notified the clinic that the company was investigating the affected person’s grievance.

“Based mostly on the details, OCR discovered that Rio Hondo did not take well timed motion in response to the affected person’s proper of entry in accordance with the HIPAA Privateness Rule,” HHS OCR stated.

HHS OCR stated it issued a Discover of Proposed Dedication in Jul. 2024 to impose a $100,000 civil financial penalty. Rio Hondo waived its proper to a listening to and didn’t contest HHS OCR’s findings, the company stated.

“Sufferers ought to by no means be within the place of needing to request their very own medical information time and again earlier than having access to them,” said OCR Director Melanie Fontes Rainer.

“Guaranteeing sufferers’ rights to well timed entry to medical info continues to be a HIPAA enforcement precedence. Healthcare suppliers are legally obligated to supply sufferers with well timed entry to their medical information,” she stated. “In the event that they fail to supply that entry, OCR is not going to hesitate to do all the things in its energy, together with imposing civil financial penalties, to make sure compliance with the regulation.”

The Los Angeles County Division of Psychological Well being, in an announcement to Data Safety Media Group, stated it’s dedicated to making sure purchasers have well timed entry to their medical information and has taken measures to make sure it stays in compliance with HIPAA requirements.

“In response to this incident, our division has taken corrective motion to make sure that all requests obtain a response inside a 30-day timeframe. This contains coaching employees concerned with receiving and processing these requests and holding weekly conferences to debate their statuses.”

No Excuses

Rose stated that Rio Hondo’s failure to supply the affected person with well timed entry to her requested information throughout the COVID-19 shutdown might need contributed to the delay, however it’s not a legitimate excuse.

“There isn’t a doubt that HHS-OCR factored that in. The variety of excuses and delays went on far past the preliminary phases of COVID, which is what OCR detailed in its foundation for the CMP,” she stated.

Will HIPAA’s right-to-access enforcement proceed to be a precedence for HHS OCR below new management when Trump administration’s takes over in January?

“There may be quite a lot of bipartisan assist for cybersecurity and privateness and safety of delicate knowledge usually,” Rose stated.

“Each administration since George W. Bush has issued government orders on cybersecurity and the HIPAA Privateness Rule has been in full swing for some time and transcended throughout multiple administration,” she stated.

“Whereas it’s not possible to foretell, affected person privateness is an space that has continued to have quite a lot of focus.”