HHS settles HIPAA right of access case with EMS company

The HHS Office for Civil Rights (OCR) resolved a HIPAA right of access case with American Medical Response (AMR), a provider of emergency medical services. As a result of the investigation, OCR imposed a $115,200 civil monetary penalty on AMR.

Under the HIPAA Privacy Rule, covered entities are required to maintain right of access provisions to ensure that patients can obtain access to their protected health information in a timely and cost-effective manner.

OCR received a complaint in July 2019 from an attorney alleging that AMR did not provide their client with a copy of the client's medical records following multiple requests. The affected individual received medical and transport services from AMR and sent a fax request in October 2018 asking for a copy of her medical records.

HIPAA's right of access provisions require covered entities to act on requests for records access within 30 days of receiving the request.

After several requests, AMR responded in March 2019, 121 days after the initial request, asking the patient to pay a fee in order to receive her records. Although AMR did have access policies in place, it amended its internal procedures following the OCR investigation to better streamline and track access requests.

The affected individual received her records in November 2019, 370 days after the initial request.

AMR waived its right to a hearing and did not contest OCR's findings. OCR alleged that AMR had violated HIPAA by failing to provide the individual with a copy of her medical records in a timely manner. OCR determined the amount of the civil monetary penalty by examining the nature and extent of the violation, any harm resulting from the violation, and a history of prior compliance and complaints at AMR regarding administrative simplification provisions.

"HIPAA gives patients a right to timely access to their medical records," said Melanie Fontes Rainer, OCR director. "OCR will continue to enforce this right through investigations, and when necessary, by imposing civil money penalties."

Jill McKeon has covered healthcare cybersecurity and privacy news since 2021.