Children’s Hospital & Medical Center in Omaha, Nebraska is paying $80,000 to settle a potential violation of the HIPAA privacy law based on a complaint that the hospital failed to provide timely access to all requested medical records.
How the story began
In May 2020, a parent filed a complaint with the Office of Civil Rights alleging that CHMC had not given her timely access to her minor daughter’s medical records. CHMC provided some but did not provide all of the information requested to the parent’s multiple follow-up requests, according to the Department of Health and Human Services’ Office of Public Affairs.
Solution
OCR initiated an investigation and determined that CHMC’s failure to provide timely access to the requested medical records was a potential violation of the HIPAA right of access standard, which requires a covered entity to take action on an access request within 30 days of receipt (or within 60 days if an extension is applicable). As a result of OCR’s investigation, the parent finally received all of the requested records.
The parent requested the information on January 3, 2020, and CHMC provided some of the requested information, according to HHS. The rest had to be collected from another CHMC division. The other data was provided on June 20, 2020, and July 16, 2020.
Explanation
“Generally, HIPAA requires covered entities to give parents timely access to their minor children’s medical records, when the parent is the child’s personal representative. OCR’s Right of Access Initiative supports patients’ and personal representatives’ fundamental right to their health information and underscores the importance of all covered entities’ compliance with this essential right”.
Robinsue Frohboese, Acting OCR Director
In addition to the monetary settlement, CHMC will undertake a corrective action plan that includes one year of monitoring. A copy of the resolution agreement and corrective action plan may be found here.
