NY Spine Settles HIPAA Right of Access Violation for $100K

The U.S. Department of Health and Human Services’ Office for Civil Rights’ HIPAA Right of Access Initiative has claimed another victim. HHS announced on October 9 that NY Spine Medicine, a private neurology and pain management practice with offices in Manhattan and Miami Beach, agreed to pay a $100,000 penalty for failing to provide patients with timely access to their medical records at a reasonable cost. This was the ninth enforcement action under OCR’s Right of Access Initiative, most recently discussed here.

OCR received a complaint from a patient who sent NY Spine multiple requests, beginning in June 2019, for a copy of her protected health information. NY Spine provided some of her records but not the diagnostic films that she had specifically requested. The patient didn’t receive a complete copy of all the records until October 2020, after OCR had intervened. HIPAA requires that requested medical records be provided as soon as possible, but no later than 30 days after receipt of the request.

In addition to the fine, NY Spine agreed to a corrective action plan that requires revisions to its HIPAA policies and procedures, training of its workforce, and periodic reports to OCR for two years. In OCR’s press release, Roger Severino, OCR Director, said, “No one should have to wait over a year to get copies of their medical records. HIPAA entitles patients to timely access to their records and we will continue our stepped up enforcement of the right of access until covered entities get the message.”