Cybersecurity Policy Report, $200,000 penalty imposed on Oregon Health & Science University for delayed patient record access, reinforcing HIPAA compliance, (Mar 7, 2025)

By WK Editorial Staff

The Office for Civil Rights has fined Oregon Health & Science University $200,000 for failing to provide timely access to patient records, highlighting the enforcement of HIPAA's Right of Access provisions.

In a decisive move to uphold the rights of patients to timely access their medical records, the Office for Civil Rights (OCR) of the U.S. Department of Health and Human Services has imposed a $200,000 civil monetary penalty on Oregon Health & Science University (OHSU). This enforcement action marks OCR's 53rd under the HIPAA Right of Access initiative, emphasizing the agency's commitment to ensuring compliance with the provisions set forth under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

The HIPAA Privacy Rule explicitly requires that covered entities, such as healthcare providers and health plans, must furnish individuals or their personal representatives with requested health information within a 30-day window, extendable by another 30 days if necessary. This rule is foundational in empowering patients, giving them necessary access to their medical information for managing their healthcare decisions effectively.

The case against OHSU unfolded following two separate complaints lodged by a personal representative who experienced significant delays in obtaining requested medical records. Despite partial compliance by OHSU in April 2019, the full records were not provided until August 2021, a delay spanning over 16 months from the initial request. This protracted timeline far exceeded the permissible response period under the HIPAA Privacy Rule, prompting OCR to take regulatory action.

The investigation by OCR revealed a concerning lapse in OHSU’s adherence to the mandated timeframe for responding to records requests. This was not the first instance of such noncompliance, as evidenced by a prior resolved complaint and subsequent notification by OCR to OHSU outlining potential noncompliance. Despite these warnings, OHSU failed to rectify its processes to ensure timely access, leading to the imposition of the penalty.

In September 2024, OCR issued a Notice of Proposed Determination to OHSU, signaling the intent to levy a $200,000 penalty. OHSU, opting not to contest the findings or request a hearing, accepted OCR's decision, which was finalized in December 2024.

This enforcement action underscores a crucial aspect of healthcare compliance—responsibility does not shift even when services are outsourced. OHSU's reliance on a business associate to handle the right of access requests did not absolve it of its duties under HIPAA. Covered entities must ensure their business associates are also in compliance with the regulations, a stipulation that OHSU overlooked, as evidenced by their failure to provide timely responses or correct errors promptly.

The penalty not only serves as a corrective measure but also as a stark reminder to all covered entities about the seriousness with which OCR views delays and noncompliance regarding patients' rights to access their medical records. This action is part of a broader effort by OCR to enforce the rights afforded under the HIPAA Privacy Rule, ensuring that individuals have the necessary tools to make informed decisions about their health and medical treatments.

For healthcare providers and institutions, this serves as a critical prompt to review and, if necessary, revamp their procedures and partnerships concerning patient information requests to avoid potential penalties and ensure compliance with federal health information privacy standards.

IndustryNews: NewsStory ComplianceNews EnforcementNews HIPAANews CyberPrivacyFeed LitigationEnforcement DataPrivacy DataSecurity