OCR Settles Seventeenth Investigation in HIPAA Right of Access Initiative

Mar 30, 2021

The Arbour, Inc., doing business as Arbour Hospital (“Arbour”), has agreed to take corrective actions and pay $65,000 to settle a potential violation of the HIPAA Privacy Rule’s right of access standard. Arbour is located in Massachusetts and provides behavioral health services.In July 2019, a complaint was filed with OCR alleging that Arbour failed to take timely action in response to a patient’s records access request made in May 2019. OCR provided Arbour with technical assistance on the HIPAA Right of Access requirements. Later, in July 2019, OCR received a second complaint alleging that Arbour still had not responded to the same patient’s records access request. OCR initiated an investigation and determined that Arbour’s failure to provide timely access to the requested medical records was a potential violation of the HIPAA right of access standard, which requires a covered entity to take action on an access request within 30 days of receipt (or within 60 days if an extension is applicable). As a result of OCR’s investigation, Arbour provided the patient with a copy of their requested records in November 2019, more than 5 months after the patient’s request.

Read on hhs.gov

OCR Settles Seventeenth Investigation in HIPAA Right of Access Initiative

Related Article

OCR: Healthcare HIPAA Compliance Report Finds PHI Security Failures