The Office for Civil Rights ('OCR') at the U.S. Department of Health and Human Services ('HHS') announced, on 30 November 2021, a Notice of Proposed Determination, issued on 19 December 2020, in its investigation into Wake Health Medical Group for violations of the Health Insurance Portability and Accountability Act of 1996 ('HIPAA'). In particular, this settlement is part of five investigations under the OCR's HIPAA Right of Access Initiative.  

Background to the Notice  

The HHS stated that the investigation was initiated by a complainant who was a patient of Wake Health, and that the OCR received a complaint alleging that Wake Health had not provided the complainant with a copy of their medical records despite making a request in person, on 27 June 2019, and paying a fee of $25 for the records. The HHS further outlined that Wake Health it is a covered entity under HIPAA. Additionally, the OCR highlighted that during the course of the investigation, the OCR learned via a phone call, on 15 April 2021, with a receptionist at Wake Health, that patients were being charged a flat fee of $25 for a copy of their medical records.  

Findings of the OCR 

The OCR investigation determined that Wake Health failed to comply with the HIPAA Privacy Rule, pursuant to the §164.524 of Subpart E of Part 164 of Subchapter C of Subtitle A of Title 45 of the Code of Federal Regulations ('C.F.R'), and the OCR's investigation showed that Wake Health had insufficient policies and procedures for responding to access to information requests promptly, thus violating §45-164.530(i) of the C.F.R., which provides for covered entities to facilitate an individual's general right to access their medical records, no later than 60 days after it is first requested.  

Outcomes 

In particular, the affected parties, the HHS, and Wake Health signed a Resolution Agreement and Corrective Action Plan, where Wake Health agreed to, among other things: 

• pay the amount of $10,000 on or before 30 November 2021;  
• comply with the Corrective Action Plan; and
• revise policies, procedures, and methods for calculating a reasonable cost-based fee for access to this sort of data. 

You can access the notice here.