OCR Right Of Access Enforcements – A Message to Dental Practices

The HHS Office for Civil Rights (OCR) recently settled three more investigations in the Right of Access Initiative it started in 2019. All three of the new enforcements involved dental practices, bringing the total number of access initiative enforcements to 41. The enforcements also come with a message directly to all dental practices from the OCR Director, Melanie Fontes Rainer, “These three right of access actions send an important message to dental practices of all sizes that are covered by the HIPAA Rules to ensure they are following the law.”

The purpose of these investigations is to ensure patients receive access to their records in a timely manner and at a reasonable cost. The HIPAA Privacy Rule requires practices to provide a patient, or the patient’s personal representative, access to requested records (including copies) within 30 days of receiving the request. If the practice needs an extension, it must contact the patient within the first 30 days in writing and explain the reason for the delay and give a date when the patient can expect their records.

These enforcements focus on the most common issues patients face when requesting their records and each investigation started in response to just one patient filing a complaint with the OCR. The investigations found the following issues:

• Timely access. Patients waited up to 6 months to be provided access to the records they requested. Providing access to all of the records requested by a patient is critical and should not require the patient to make multiple requests.
• Reasonable, cost-based fees. HIPAA requires that any fee charged to patients for record requests must be reasonable and cost based. One enforcement focused on a practice that required a patient to pay a $170 copying fee before it would provide the patient a copy of the requested records. Previous guidance from the OCR has stated that copies provided to a patient electronically must be provided at no cost to the patient and may not be based on a per page fee. The guidance outlines a few methods for determining actual costs if the provider must charge the patient a fee higher than the set recommendation of $6.50. The OCR states that amount should cover most routine record requests and any supplies like a USB drive.

Other important aspects to remember are:

• Requests from a patient’s personal representative such as a parent, legal guardian, a healthcare power of attorney, etc. falls under the same rule and should be treated just like a request from the patient.
• Access request rules apply to current and former patients.
• A record request cannot be denied because a patient has a balance due with the practice.
• There can be no unreasonable processes or barriers to a patient requesting access to their records. One of the three enforcements found that after a patient’s initial request for records via email, the practice then required a written request with a handwritten signature before it would provide the records. If a patient emails a request for their records, it is considered sufficient documentation for the practice to provide those records once the practice confirms the email address belongs to the patient. For example, if the patient’s email is not on file, call to confirm the request and email address and document the call in the patient’s file.

These investigations and enforcements are not slowing down anytime soon and come with additional administrative time and costs to each practice to comply with the corrective action plan that comes with it. Corrective action plans from the OCR require a practice to be monitored closely by the OCR for up to 2 years and comply with any documentation and reporting requirements and deadlines related to the details of the enforcement. In addition to that, the most recent enforcements carried settlement fees between $25,000 – $80,000 to be paid to the OCR. Overall, the average amount assessed to practices for the Right of Access Initiative enforcements is nearly $60,000, with the highest being $240,000.

It’s important to have the right resources to ensure your process follows the proper guidelines. TMC clients not only have immediate access to forms and guidance in our Client Portal but they also have a personal consultant as well as easy access to expert support by contacting Client Services. If you would like to learn more about this important subject, visit our website to view Abby Mitchell’s “How Does Your Practice Respond to a Patient’s Right of Access?” webinar, that was recorded on May 5, 2022. – by Abby G. Mitchell, HCISPP, CRISC, CHPC, CHC