HHS Office of Civil Rights Settles its First Medical Records Enforcement Case

Earlier this year, the Office for Civil Rights (“OCR”) of the U.S. Department of Health and Human Services (“HHS”) announced that it would vigorously enforce the Federal rights of patients to receive their medical records promptly and without being overcharged. On September 6, 2019, the OCR entered into a settlement agreement with Bayfront Health-St. Petersburg to resolve an enforcement action brought under the Health Insurance Portability and Accountability Act (“HIPAA”). As part of the settlement, Bayfront agreed to pay an $85,000 fine and to adopt a correction plan of action to improve patient access to medical records.

Read the HHS press release.

Read the Resolution Agreement between the HHS and Bayfront.

The facts of the Bayfront enforcement action are egregious and fully merit the stiff fine imposed as a result of the settlement. The OCR alleged that on August 14, 2018 it received a complaint from a mother who claimed she requested her fetal heart monitor records from Bayfront beginning in October 2017. The mother then hired counsel, who requested the records on January 2, 2018 and February 12, 2018. Bayfront provided an incomplete set of records in March 2018 and did not provide a complete response to the attorney until August 23, 2018.

The Health Information Technology for Economic and Clinical Health Act, known as the HITECH Act, is codified at 42 U.S.C. § 17935(e). It provides a that in applying the regulation that governs a patient’s right to obtain medical records from a “covered entity,” 45 C.F.R. § 164.524, titled “Access of individuals to protected health information,” the individual shall have the right to obtain a copy of such records in an electronic format. The definition of “covered entity” includes health plans, health plan clearinghouses, and health care providers that transmit health information in electronic format.

45 C.F.R. § 164.524 provides that an individual has the right to obtain a copy of the individual’s medical records, other than psychotherapy notes and information compiled in reasonable anticipation of or use for a civil, criminal, or administrative action or proceeding. The covered entity must act on a request for access no later than 30 days after receipt of the request. However, if the covered entity is unable to act within 30 days, the covered entity may extend the time for it act by no more than 30 days. The covered entity must provide the requesting individual a written statement of the reasons for the delay and the date by which the covered entity will complete its action on the request. A covered entity is entitled to only one such extension.

A covered entity must provide the individual with access to the protected health information in the form and format requested by the individual, including electronic format if the covered entity’s records are readily producible in such form and format.

A covered entity can charge “a reasonable cost-based fee” for providing medical records but may charge only the cost of labor, supplies, and postage. However, the fee that can be charged is further limited by the HHS’s Frequently Asked Questions, which provide that a covered entity may charge individuals a flat fee of $6.50 for all requests for electronic copies of personal health information maintained electronically. The $6.50 fee is not the maximum that may be charged but is an option for covered entities that do not want to go through the process of calculating the actual or average allowable costs.

The Bayfront action was intended to send a message to the health care industry. According to OCR Director Roger Severino, “We aim to hold the health care industry accountable for ignoring peoples’ rights to access their medical records and those of their kids.”

© Andrew Whiteman 2019


Whiteman Law Firm handles cases that involve patient access to their medical records. Click here for more information about what we do. Please contact us for more information.