Cybersecurity Policy Report, HEALTH CARE COMPLIANCE NEWS—New Jersey SNF hit with $100K CMP for HIPAA violation over timely access to medical records, (Apr 3, 2024)
Organizations Mentioned:Hackensack Meridian Health
By WK Editorial Staff
Hackensack Meridian Health failed to provide a patient’s personal representative with timely access to the patient’s medical records.
HHS Office for Civil Rights (OCR) imposed a $100,000 civil monetary penalty (CMP) on Essex Residential Care, LLC, operating as Hackensack Meridian Health, West Caldwell Care Center (Hackensack Meridian Health). Hackensack failed to respond timely to a HIPAA right of access request. In September 2023, OCR issued a Notice of Proposed Determination seeking to impose a civil money penalty, followed by a Final Determination earlier in 2024.
The enforcement action follows the investigation into Hackensack Meridian Health's failure to provide a patient’s personal representative with prompt access to medical records, as required under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule. In May 2020, OCR received a complaint alleging that Hackensack Meridian Health failed to provide a personal representative with access to his mother’s medical records. Despite having received adequate documentation confirming his status as his mother’s personal representative, the records were not provided until November 2020, well beyond the acceptable timeframe, and only after OCR's intervention.
As such, the OCR found that Hackensack Meridian Health failed to act on a request for access to medical records within the required HIPAA 30-day period after receipt of the request. The facility's response to the request was overdue by a significant 161 days, highlighting a disregard for the established rights of patients and their personal representatives. Additionally, Hackensack Meridian Health waived its right to a hearing and did not contest the OCR’s findings, leading to the imposition of the $100,000 CMP. Although the facility received a Notice of Proposed Determination, which outlined the potential penalty and the findings, Hackensack did not challenge the OCR’s findings, thus waiving its right to a hearing and the penalty became final.
IndustryNews: NewsStory AgencyNews GeneralNews ComplianceNews CMPNews EHRNews HIPAANews SNFNews CyberPrivacyFeed DataPrivacy DataSecurity