OCR Settles Multiple HIPAA Right of Access Complaints With Optum Medical Care

The HHS Office for Civil Rights (OCR) announced its 46th enforcement action under the HIPAA Right of Access Initiative. The enforcement action resolved an investigation into Optum Medical Care, a multi-specialty physician group that serves patients in New Jersey and Southern Connecticut. Optum Medical Care agreed to pay $160,000 to OCR and implement a corrective action plan to resolve the allegations.

OCR launched an investigation into Optum Medical Care in Fall 2021 after receiving six individual complaints from various patients alleging that Optum Medical Care had failed to provide copies of medical records to patients and to the parents of minor patients.

The HIPAA right of access provisions requires covered entities to provide patients with timely and cost-effective access to their medical records. Specifically, HIPAA entitles patients to receive access to their information within 30 days of sending a request to their provider.

When OCR investigated Optum Medical Group, it found that patients had received their requested records between 84 and 231 days after their requests were submitted, constituting a potential HIPAA violation.

Optum Medical Care admitted no wrongdoing but agreed to the $160,000 monetary settlement and corrective action plan. Under the terms of the corrective action plan, Optum Medical Care agreed to revise its right of access policies and procedures, report records requests to OCR, and provide training to workforce members. OCR will also monitor the organization for one year to ensure compliance with the corrective action plan.

“[Healthcare] providers must make responding to parents’ or patients’ request for access to their medical records in a timely manner a priority,” said OCR Director Melanie Fontes Rainer.

“Access to medical records is a fundamental right under HIPAA, and one for which OCR receives thousands of complaints each year. This is the law—providers must proactively respond to record requests and ensure timely access. Access to medical records empowers patients and their families to make decisions about their health care and improve their health overall. It is critical that providers follow the law.”

Maintaining a solid understanding of the HIPAA right of access requirements is crucial for ensuring compliance and avoiding OCR investigations. HIPAA-covered entities should respond to access requests in a timely manner, consider the patient’s requested record format, and communicate with patients along the way.