U.S. Department of Health & Human Services
03/29/2024 | Press release | Distributed by Public on 03/29/2024 08:09
HHS’ Office for Civil Rights Settles HIPAA Investigation with Phoenix Healthcare
This settlement marks the 47th enforcement action in the OCR Right of Access Initiative
Today, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), announced a settlement with Phoenix Healthcare, an Oklahoma multi-facility organization in nursing care. The settlement resolves a potential violation under the Health Insurance Portability and Accountability Act (HIPAA) Right of Access provision, requires that individuals or their personal representatives have timely access to their health information.
Under HIPAA, it is required that a covered entity must provide access to the protected health information within 30 days of receiving an individual's request. OCR's investigation involved a daughter, serving as a personal representative for her mother, who was not able to obtain access to her mother's protected health information for nearly one year, despite multiple requests. The agreement marks OCR's 47th Right of Access enforcement action.
"Patients need to make the best decisions possible for their health and well-being, so timely access to their medical records is imperative," said OCR Director Melanie Fontes Rainer. "Without this access, patients are at risk for incorrect treatments, inaccurate health records, and lack of understanding of their health conditions. It is unacceptable for a health care provider to delay or deny requests to release medical records for months, and we are calling on providers everywhere to be compliant to help empower patients."
In April 2019, a complaint was filed with OCR alleging that Phoenix Healthcare would not provide a daughter, who serves as a personal representative, with a copy of her mother's medical records. After attempt at technical assistance and attempts to get the records by OCR, Phoenix Healthcare sent the requested records on January 30, 2020, 323 days after the request.
A copy of the Settlement Agreement may be found at: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/phoenix-healthcare/index.html.
The regulations under HIPAA recognize the importance of providing individuals with the ability to access and obtain a copy of their health information. To learn more about your rights under the HIPAA Right of Access provision, view OCR's guidance at: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html.
The HIPAA Privacy rule requires regulated entities to provide an individual's personal representative with medical records. To learn more about the rights of a designated representative, view OCR's guidance at:
https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/personal-representatives/index.html.
OCR is committed to enforcing the privacy and security of peoples' health information that is protected under HIPAA. If you believe that your or another person's health information privacy or civil rights have been violated, you can file a complaint with OCR at: