OCR settles 54th HIPAA right of access case

The HHS Office for Civil Rights, or OCR, reached a settlement with Concentra, a Texas-based occupational health services provider, over alleged violations of the HIPAA Privacy Rule's right of access provisions. The settlement marked the 54th case settled by OCR under its right of access initiative. Concentra agreed to pay $112,500 to resolve the allegations. 

The HIPAA Privacy Rule's right of access provisions require that covered entities provide individuals with their requested health records within 30 days, at a reasonable cost. There is an opportunity for one 30-day extension, if needed. 

The Concentra case originated from a complaint filed with OCR alleging that an individual had not received timely access to his health information, despite making six requests to Concentra beginning in February 2018.  

In October 2018, Concentra's business associate responded to the request by allegedly sending an invoice to the individual for $82.57, which was disputed. In March 2019, the business associate adjusted the balance to $6.50 and sent the individual their health information via mail, more than a year after the initial request. 

In July 2020, OCR notified Concentra that it had found indications of noncompliance with the HIPAA Privacy Rule, which Concentra disputed. By June 2021, Concentra and OCR agreed to a monetary settlement to resolve the case prior to an administrative hearing. The settlement did not appear to include a corrective action plan. 

"Under the HIPAA Privacy Rule, individuals or their personal representatives have the right to timely access their medical records," OCR Director Paula M. Stannard said in the settlement announcement.  

"Individuals should not have to make multiple requests and file a complaint with OCR to gain access to their health information." 

Jill Hughes has covered healthcare cybersecurity and privacy news since 2021.