Please support Telehealth.org’s ability to deliver helpful news, opinions, and analyses by turning off your ad blocker.
We’ve discussed the US Department of Health and Human Services Office for Civil Rights’ “HIPAA Right of Access Initiative” in several previous articles. On May 8, the 44th enforcement action under the Initiative involved investigating a complaint against a Licensed Professional Counselor (LPC) who allegedly refused to release medical records. Despite receiving technical assistance from the OCR, the counselor, as a covered entity, reportedly did not provide the records.
OCR Director Melanie Fontes Rainer stated:
Under HIPAA, parents, generally being the personal representatives of their minor children, have the right to access their children’s medical records. It’s unacceptable for an individual or their parent representative to wait nearly six years and file multiple complaints just to get patient records.
HIPAA rules can be complex, particularly for smaller providers, but they have existed for almost three decades. Although the intricacies of HIPAA privacy, security, and breach notification requirements might still be fuzzy to some providers, compliance with the law is mandatory for all HIPAA “covered entities.”
Adherence to HIPAA goes beyond simply providing patients with a Notice of Privacy Practices or having a secure electronic medical record system. This is true for licensed people: telehealth, teletherapy, and traditional in-person providers who use electronic services, such as billing, email, texting, etc. Associated uncertainties can be challenging to remedy, especially for small groups or independent practitioners who often serve as their own HIPAA Compliance Officers.
Details of the LPC’s Right of Access Settlement
The recent OCR settlement of the recent LPC case involving the Right of Access Initiative concluded with a $15,000 resolution and a requirement to adhere to a two-year corrective action plan (CAP). The OCR typically offers assistance, and if a…