For quite a while now, many have wondered when OCR would broaden its enforcement focus to include not only members of the regulated community that have suffered breaches, but also those that have held patient data a little too close to the vest — and have not timely provided copies to patients upon request, charging a reasonable cost-based fee, in accordance with the HIPAA regulations.
Today, OCR announced a settlement agreement with a Florida tertiary care hospital that had failed to provide a patient with a copy of a requested medical record. (In this case, it was an expectant mother who requested records of her unborn child, and filed the complaint with OCR when she couldn’t get them.)
Presser and resolution agreement detailing the $65,000 fine and further corrective actions are available here.
Here’s hoping that recalcitrant covered entities get the message.
