7 unlucky physician practices show the risk of patient access errors

by: Julia Kyles, CPC Mar 24, 2021

Your practice should expect to get docked several thousand dollars and be ready to enter a mandatory corrective action plan if it doesn’t have a system for responding to patient requests for medical records and other protected health information (PHI). It only takes one patient to trigger an expensive settlement.

The HIPAA right of access initiative is still going strong, and a review of settlements shows that a small practice can expect technical assistance from the HHS Office for Civil Rights (OCR) after it receives a patient complaint. But a practice can’t expect a second chance from OCR if the patient submits a second complaint.

Seven practices paid an average of $29,000 to settle allegations that they violated HIPAA’s patient access rules, with payments ranging from $3,500 to $100,000. In addition, each practice had to enter a corrective action plan, which comes with the potential for more payouts if they fall out of compliance with the plan.

A list of patient access settlements paid by physician practices, including a summary of allegations and the settlement amount, is provided below. But consider here a few universal lessons:

Treat the request with urgency. It is a patient care matter, a patient satisfaction matter and a compliance matter.
Assign one person to handle requests and make sure everyone in the practice knows where to direct requests.
Tell your patients how to submit requests, explain any limits on your ability to fulfill a request – for example, you can’t burn records onto a CD-ROM if you don’t have the equipment – set a reasonable timeline for sending PHI and stick to it.
Let the patient know if there is an unavoidable delay and give an estimate for when they can expect the records.
Do what the patient wants. For example, if a patient who has cancer wants a copy of his records sent to his home, but you send them to the patient’s oncologist, not only will you be out of compliance with patient access rules, but it might be viewed as an unauthorized disclosure.

In detail: 7 patient access settlements

Case #1:

Provider: Psychiatry practice Patricia King M.D. & Associates, Chesapeake, Va.
Settlement amount: $3,500
Summary of allegations: The practice failed to give a patient access to her PHI. The OCR gave the practice technical assistance about the patient’s right of access on Nov. 30, 2018, approximately one month after it received the patient’s complaint. The OCR received a second complaint about the practice on Feb. 13, 2019.

Case #2:

Provider: Psychiatry practice Wise Psychiatry, P.C., Centennial, Colo.
Settlement amount: $10,000
Summary of allegations: The practice failed to provide timely access to a minor’s PHI to the father of the patient, after the father sent the request via certified mail which it signed for Dec. 4, 2017. The practice did not send a copy of the requested records until May 30, 2019 – after OCR investigated the matter in response to the father’s complaint.

Case #3:

Provider: Otolaryngologist Dr. Rajendra Bhayani, Regal Park, NY
Settlement amount: $15,000
Summary of allegations: The patient requested her medical records in July 2018. The OCR received a complaint from the patient in September 2018 and provided technical assistance to the practice. The OCR received a second complaint from the patient who still had not received her records in July 2019. The patient received a complete copy of her records after the OCR investigated, in September 2020.

Case #4:

Provider: Multi-specialty practice All Inclusive Medical Services, Carmichael, Calif.
Settlement amount: $15,000
Summary of allegations: AIMS failed to provide a patient with a copy of her medical records and refused her request to inspect her records. The patient submitted a complaint to OCR on April 25, 2018.

Case #5:

Provider: Riverside Psychiatric Medical Group, a psychiatry practice in Riverside, Calif.
Settlement amount: $25,000
Summary of allegations: The practice failed to give a patient a copy of her medical records despite multiple requests beginning in February 2019. The OCR received a complaint in March 2019. The OCR gave the practice technical assistance, but in April 2019 the OCR received a second complaint from the patient.

Case #6:

Provider: Primary care practice Elite Primary Care, Waycross, Ga.
Settlement amount: $36,000
Summary of allegations: The OCR received a complaint from a patient, April 22, 2019 and provided technical assistance to the practice, May 2, 2019. The practice received a second request from the patient June 5, 2019. The OCR received a second complaint from the patient, Oct. 9, 2019. The practice sent the patient’s records to the patient’s new provider, Nov. 21, 2019, and to the patient on May 8, 2020.

Case #7:

Provider: Pain medicine and neurology practice NY Spine Medicine, New York City and Miami Beach, Fla.
Settlement amount: $100,000
Summary of allegations: The patient sent several requests to the practice for her X-ray, MRI and CT scan images, starting on June 10, 2019. The OCR received her complaint on July 22, 2019. The OCR sent its first attempt to notify the practice of the complaint on Oct. 9, 2019. The OCR made several additional attempts to contact the practice by mail, certified mail and phone call but did not receive a response from the practice until March 6, 2020.

Blog Tags: compliance, HHS, Privacy, security

To comment, login here.

Login

User Name:
Password:
Remember me Forgot password
Welcome to the new Part B News Online. If you are a returning user having trouble logging in, please click here.