The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) implemented its 53rd HIPAA Right of Access enforcement action.
The action, is a $200,000 civil monetary penalty against Oregon Health & Science University (OHSU) “for violating an individual’s right to timely access her medical records through a personal representative,” according to HHS.
The representative registered a complaint to OCR in January 2021. HHS reported that this was “the second complaint OCR received on this matter.” The first complaint was received in May 2020 and settled in September that same year. OCR “notified OHSU of its potential noncompliance with the Privacy Rule Right of Access provisions.”
Following the January 2021 complaint, OCR conducted an investigation. The patient records were partially released in April 2019, but not fully provided until August 2021, 11 months after receiving OCR’s letter.
OCR concluded that OHSU “failed to take timely action in response to the right of access requests.” Additionally, they initiated a $200,000 civil monetary penalty against OHSU in December 2024.
