Why was the Behavioral Health Provider Fined?
Under the HIPAA right of access standard, behavioral health providers are required to provide patients with access to their medical records within 30 days of a request, in the format the patient requests them in. Under this provision, providers are limited in how much they can charge (reasonable cost-based fee) to provide copies of medical records to patients. Although behavioral health providers do not need to provide access to psychotherapy notes, they must provide patients with access to the rest of their records. Read more about previous violations of the HIPAA right of access and its fines information provided by TBHI.
- HIPAA Right of Access
- OCR announced 12 HIPAA Right of Access Violations
- HIPAA Right of Access Enforces Fines in 2020
- Two HIPAA Right of Access Violation Settlements Announced
In July 2019, the HHS’ OCR received a complaint from a patient alleging that Arbour Hospital (Arbour) failed to provide him with timely access to his medical records; the patient initially requested his records in May 2019. As a result of the complaint, OCR conducted an investigation and provided Arbour with technical assistance to provide the patient with access to his records. OCR then closed the complaint. However, OCR received a second complaint on July 28, 2019, when the patient still had not received his requested records. After the second OCR investigation concluded in November 2019, Arbour finally provided the patient with his medical records.
“Health care providers have a duty to provide their patients with timely access to their own health records, and OCR will hold providers accountable to this obligation so that patients can exercise their rights and get needed health information to be active participants in their health care,” said Acting OCR Director Robinsue Frohboese.
What are the Terms of the Right of Access Violation Settlement?
The behavioral health provider has agreed to pay a fine of $65,000 and enter into a corrective action plan (CAP) that includes one year of OCR monitoring. The provisions of the CAP require Arbour to develop and implement:
- A “Right of Access to PHI” policy to ensure comprehensive and timely responses to requests for records;
- Protocols for training all Arbour’s workforce members and business associates that are involved in receiving or fulfilling access requests, as necessary and appropriate to ensure compliance with the “Right of Access to PHI” policy;
- A sanctions policy, to be applied against Arbour workforce members who fail to comply with the “Right of Access to PHI” policy; and
- A process for reviewing business associate performance with regard to access requests and responses and for terminating relationships with business associates who fail to permit Arbour to comply with the “Right of Access to PHI” policy.
To read the full settlement, please click here.
Need assistance with HIPAA compliance? Compliancy Group can help! They help you achieve HIPAA compliance, with Compliance Coaches® guiding you through the entire process. Find out more about the HIPAA Seal of Compliance® and Compliancy Group. Get HIPAA compliant today!
Have More Specific Questions about COVID-19 Telehealth Best Practices?
While we all know how important it is for our services to continue with COVID-19 telehealth best practices, but many professionals are unsure of how to proceed with the many legal and ethical foundation issues of relevance to telehealth, PLUS the regularly updating legal and regulatory changes that must be integrated. To help practitioners and their administrators make sense of COVID-19 telehealth best practices as applicable to working from home, and as a community service, TBHI is honored to be working with the California non-profit, Telehealth Institute to bring you this up-to-date, FREE informational course designed specifically for behavioral professionals.