Today, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced a civil monetary penalty of $115,200 collected against American Medical Response (AMR), a provider of emergency medical services across the United States. The civil monetary penalty was the result of an investigation based on a complaint that AMR had failed to provide a patient with timely access to their medical records. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule’s right of access provisions require that individuals or their personal representatives have timely access to their health information (within 30 days, with the possibility of one 30-day extension) and for a reasonable, cost-based fee.
“HIPAA gives patients a right to timely access to their medical records,” said OCR Director Melanie Fontes Rainer. “OCR will continue to enforce this right through investigations, and when necessary, by imposing civil money penalties.”
OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules, which set forth the requirements that covered entities (health plans, health care clearinghouses, and most health care providers) and business associates must follow relating to the privacy and security of protected health information. The HIPAA Privacy Rule establishes national standards to protect individuals’ medical records, sets limits and conditions on the uses and disclosures of protected health information, and gives individuals certain rights, including the right to timely access and to obtain a copy of their health records.
OCR received a complaint alleging that AMR failed to provide a patient with timely access to their medical records after many failed attempts by the patient. OCR initiated an investigation and found that AMR failed to provide the patient with timely access to their medical records. In response to OCR’s investigation, AMR sent the patient a copy of their requested records and amended its internal procedures to streamline and better track right of access requests to follow the law. In October 2023, OCR issued a Notice of Proposed Determination seeking to impose a civil money penalty. AMR waived its right to a hearing and did not contest OCR’s findings. OCR finalized its determination and imposed the civil money penalty against AMR.
OCR is committed to enforcing the HIPAA Rules that protect the privacy and security of peoples’ health information. Guidance about the Privacy Rule, Security Rule, and Breach Notification Rule can also be found on OCR’s website.
If you believe that your or another person’s health information privacy or civil rights have been violated, you can file a complaint with OCR.