If the penultimate enforcement settlement of 2023 issued by the HHS Office for Civil Rights (OCR) sounds familiar, that’s with good reason. And the last one of the year should ring some bells, too.
That’s because OCR’s two settlements announced in December for alleged HIPAA violations by an emergency medicine practice in Louisiana and a multispecialty group operating in parts of New Jersey and Connecticut demonstrate two common failings, both historic and more recent: lack of a security risk analysis and tardiness or nonresponsiveness to a patient’s request to access medical records.
But while these settlements might not have been surprising, another HHS announcement was: according to the most recent update of federal rules under development, OCR is planning to revise the security rule as part of an agency-wide effort.[1] In addition, officials described a new cybersecurity strategy for the health care sector.[2]
Along with its regulatory actions, OCR pledged to continue pursuing enforcement when there are alleged HIPAA violations. In 2023, the agency issued a total of 13 settlements—bracketed on both ends by exactly the type of cases with which it concluded the year.[3]
Settlements Were Down, Recoveries Up
At the high end was a $1.3 million payment from L.A. Care following a small breach and a mis-mailing of some members’ cards, but the lack of a security analysis was the primary basis for the high penalty. At the low end was a $15,000 payment in a case in which a psychiatrist did not give a father a copy of his minor children’s records despite repeated requests.
In total, the 13 settlements last year brought OCR $3,982,500. In 2022, it took $2,172,640 from 22 regulated entities; 17 were right-of-access cases, compared to just four in 2023. Nary a dentist was among them: in 2022, eight dentists felt OCR’s regulatory might.
Turning to the most recent settlement, records issues, as noted, involving Optum Medical Care of New Jersey, triggered a $160,000 settlement that includes a two-year corrective action plan (CAP), according to OCR’s Dec. 15 announcement.[4] The practice was previously known as Riverside Medical Group and Riverside Pediatric Group. This marked OCR’s 46th settlement of this type since the access initiative began in 2019 under then-OCR Director Roger Severino.
Optum officials did not respond to specific questions from RPP about the settlement or records access issues. “Optum has long supported patients’ timely access to their health information. We have addressed the cause of this issue and are sorry for any inconvenience it may have caused,” a spokesperson said in an email.
