Fines Of $20,000 Imposed On Florida Primary Care Provider For Breach Of HIPAA Right Of Access

Health Specialists of Central Florida Inc. (HSCF), located in Orlando, Florida, recently paid a $20,000 financial penalty to the Office for Civil Rights (OCR) at the Department of Health and Human Services (HHS) to settle a case related to the HIPAA Right of Access. The investigation began after a woman filed a complaint that she had not been provided with a copy of her deceased father’s medical records. The initial request was submitted on August 29, 2019, and was accompanied by authorization forms and Letters of Administration. The records were only provided after multiple requests and nearly five months had passed. 

OCR determined that the delay violated the HIPAA Right of Access, which requires healthcare providers to provide the requested records within 30 days of the request, or, in certain cases, within a 30-day extension. As part of the settlement, HSCF agreed to develop and implement HIPAA Privacy Rule policies and procedures concerning the HIPAA Right of Access, as well as distributing those policies and procedures to staff and providing training on them. OCR will monitor HSCF for two years from the date of the settlement. 

Since OCR launched the HIPAA Right of Access enforcement initiative in the fall of 2019, 42 enforcement actions have been resolved with healthcare providers paying a total of $2,423,650 in fines. The fines have ranged between $3,500 and $240,000. OCR emphasizes the importance of the right of patients to access their health information and is committed to ensuring that healthcare providers and health plans take this right seriously.

Melanie Fontes Rainer, the Director of OCR, stressed the importance of patient access to health information, which is a cornerstone of HIPAA. “We will make sure health care providers and health plans take this right seriously and act according to the law,” she declared while announcing the settlement. “Today’s announcement highlights the importance of access to information and regulated entities taking steps to make sure they are helping patients access it in the best possible way, with procedures and workforce training.”