* Breaking News *
The Office for Civil Rights (OCR) just announced its first settlement in the HIPAA Right of Access Initiative.
Bayfront Health St. Petersburg paid an $85,000 settlement and entered a corrective action plan with the OCR to resolve allegations that it violated the HIPAA Privacy Rule by denying a patient the right to timely access to the medical records of her unborn child.
The patient requested prenatal records of her unborn child from Bayfront, a 480-bed hospital in Florida. HIPAA requires covered entities to comply with such requests within 30 days. When the patient did not receive her records, she filed a complaint. The patient eventually received her records - more than nine months after her original request.
Don't forget patient rights
HIPAA gives patients rights, and providers who don't protect those rights can face hefty settlements.
Patients have the right to:
- receive your notice of privacy practices
- see or copy their PHI
- ask to make changes to their medical records
- restrict how their PHI is used and communicated
- ask who has received their PHI
- give permission to discuss PHI with family and friends
- have their PHI protected after they die
What you can do
- Implement policies protecting patient privacy rights.
- Train staff to be aware of these rights, so they know what to do if a patient asks about how to exercise their rights.
- Audit your organization's adherence to these policies. For example, do you honor medical records requests within 30 days? If a patient requests a communication restriction, is it documented and followed? Use what you find in your audits to improve your policies and training and continually improve your efforts to honor patient privacy. Your patients and your employees will thank you.