Recently, the United States Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced a $115,200 civil monetary penalty against American Medical Response for failure to provide a patient with timely access to their medical records. Under HIPAA, patients are entitled to timely access to copies of their medical records and failure to provide that access is enforced under the Right of Access initiative through HHS OCR.
The Right of Access initiative requires that individual patients (and their personal representatives) be allowed access to their health information, for a reasonable cost-based fee. Timely access is defined as within 30 days, with the opportunity for a 30-day extension if the covered entity requests it. The request for extension should include a written statement of the reasons for the delay and the date by which it will provide the requested information.
American Medical Response provides emergency medical services across the United States. On October 31, 2018, a patient requested a copy of their medical records through their attorney via fax. On November 8, 2018, the request was sent again to American Medical Response via certified mail. In January 2019, two follow up requests were sent via certified mail and fax. American Medical Response did acknowledge that the requests were sent to addresses and/or fax numbers that it had access to.
It wasn’t until March 1, 2019 – 121 days after the initial request – that American Medical Response sent an invoice that required payment before the records would be provided. On March 18, 2019, the requestor again asked that the records be sent electronically as requested or the requestor would file a complaint with HHS OCR.
In July 2019, a complaint was filed with HHS OCR regarding the failure to provide requested medical records in a timely manner. OCR notified AMR in October 2019 that it was investigating the complaint and on November 5, 2019 – 370 days after the initial record request – the records were finally sent to the requestor.
OCR notified American Medical Response of its investigation results on August 3, 2021, and offered an opportunity to informally resolve the matter. American Medical Response responded by asking OCR to “reconsider its position” without providing any counteroffer or otherwise engage in negotiations with OCR. On April 15, 2022, OCR sent a Letter of Opportunity to American Medical Response, which the company responded to on May 16, 2022.
Ultimately, in October 2023, HHS OCR issued a Notice of Proposed Determination regarding the incident. In that notice, OCR noted that it had received numerous Right of Access complaints against AMR, but it was a “neutral” factor in assessing the overall penalty of $115,200.
Upon receiving the notice of proposed determination, AMR did not contest OCR’s findings, waived its right to a hearing, and agreed to pay the penalty. AMR also told OCR that it amended its internal procedures to streamline and better track Right of Access requests to comply with the law.
“HIPAA gives patients a right to timely access to their medical records,” said OCR Director Melanie Fontes Rainer. “OCR will continue to enforce this right through investigations, and when necessary, by imposing civil money penalties.”