New year, new you. That’s how the saying goes. For the HHS Office for Civil Rights (OCR), 2022 did bring a change in the “you” leading the agency, but its enforcement actions continued apace from 2021. Seventeen of OCR’s 22 enforcement actions last year were for right-of-access violations related to medical records.[1] It had 12 such cases in 2021 and is now up to 43—with a new $16,500 settlement announced Jan. 3.
Last year also seemed to be the year of the dentist, as OCR acted against eight dentists or dental practices for access violations but also for other reasons. Two got in trouble for revealing protected health information (PHI) attempting to defend themselves following online reviews.
Then there was the dentist who allowed his campaign staff to pitch his state senate race to patients. He lost the election and paid OCR $65,000 to boot.
Overall, OCR collected $2,172,640 last year from 22 covered entities. This is an increase of seven over the number subject to enforcement action in 2021. But 2021 was more lucrative for the agency; that year, OCR collected $5.98 million, of which $5.1 million came from Excellus Health Plan, whose data breach affected 9.3 million individuals.
OCR Ended 2022 As It Began
Lisa Pino, who was appointed OCR director in September 2021, left OCR in July 2022 and was replaced by Melanie Fontes Rainer, who was sworn in on Sept. 14, 2022.[2] Despite the change in leadership, OCR continued issuing right-of-access settlements. As of RPP’s deadline, OCR had already issued its first agreement of 2023—another access case.
The January settlement followed two in December. None of the organizations involved responded to RPP’s requests for comment.
As noted, OCR issued a new settlement Jan. 3. It announced that Life Hope Labs of Sandy Springs, Georgia, agreed to pay $16,500 and follow a two-year corrective action plan (CAP).[3]
According to OCR, the personal representative of a deceased patient complained to OCR on Aug. 24, 2021, that records requested in July had not been received. Ultimately, the records were sent on Feb. 16 last year, which OCR noted was “225 days after the…initial access request.”
Unlike in other resolution agreements, OCR did not indicate whether its involvement was the impetus for release of the records. The agency accused Life Hope Labs only of failing to provide timely access to the records, required under 45 C.F.R. § 164.524.
The CAP calls for Life Hope Labs to revise its policies and procedures. Specific tasks include establishing standardized procedures for responding to requests for access, protocols for training workforce members and business associates “involved in receiving or fulfilling access requests as necessary;” as well as “protocols for training Life Hope Labs’ workforce members that are involved in the maintaining of designated record sets and other protected health information.” Life Hope Labs also must establish sanctions for noncompliance with the policies and procedures.
After HHS approves Life Hope Labs’ policies and procedures, it has 60 days to conduct training, which must be repeated “at least every [12] months thereafter” and within 30 days of a new hire or business associate beginning work.
