The Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services announces its sixteenth settlement in its HIPAA Right of Access Initiative enforcement. OCR announced this initiative to support individuals’ rights to timely access their health records at a reasonable cost under the HIPAA Privacy Rule.

Sharp HealthCare, doing business as Sharp Rees-Stealy Medical Centers ("SRMC"), has agreed to take corrective actions and pay $70,000 to settle a potential violation of the HIPAA Privacy Rule's right of access standard.

In June 2019, a complaint was filed with OCR alleging SRMC failed to take timely action in response to a patient’s records access request directing an electronic copy of their PHI be sent to a third party. In August 2019, OCR received a second complaint alleging SRMC had still not responded to the patient’s records access request.

"Patients are entitled to timely access to their medical records. OCR created the Right of Access Initiative to enforce and support this critical right," said acting OCR Director Robinsue Frohboese.

Security and compliance are first and foremost in the management of our clients' systems. After conducting thousands of SRAs, common vulnerabilities began to emerge. We launched HIPAA Tip Tuesday to make clients aware of what actions they can take to address these vulnerabilities.