Californian Mental Health Center Fined $100,000 for HIPAA Violation, P2

Shidonna Raven
4 hours ago
3 min read

November 20, 2024

The patient called Rio Hondo on several occasions in August 2020 and did manage to speak to a member of staff, but there was no follow-up. On August 21, 2020, the patient filed a complaint with OCR. On October 7, 2020, OCR contacted Rio Hondo regarding the complaint. Rio Hondo called the patient that day, and again on October 8 and October 16, and left voicemails for the patient, then sent a letter of apology on October 19, 2020, and sent the requested records by certified mail the following day.

OCR investigated and was informed that the Intermediate Typist Clerk (ITC) assigned to respond to medical record requests was alerted when the patient arrived at the clinic on May 27 but delayed the meeting to consult with multiple colleagues about how to process the record access request. The ITC said one attempt was made to contact the patient when she learned that the patient had left the clinic, but there were no further follow-ups. The ITC confirmed that she was notified about the patient’s calls on July 17, but could not recall if she or any other staff member returned the patient’s calls.

OCR notified Rio Hondo about the findings of the investigation on August 31, 2022, and that the failure to provide a timely copy of the medical records was a violation of the HIPAA right of access, and Rio Hondo was given the opportunity to settle the matter informally. Rio Hondo was notified on February 3, 2023, that no attempt had been made to settle the matter informally, and was provided with an opportunity to submit written evidence of mitigating factors.

Rio Hondo responded and explained that the records could not be processed in the first 60 days due to the stay-at-home order, and after that date, several attempts were made to contact the patient but the patient did not respond. Rio Hondo also confirmed that protocols had been changed to ensure that similar situations were prevented in the future. OCR determined that the submitted evidence did not support a waiver of a civil monetary penalty, and imposed a $100,000 penalty for the 156 days that the records were not provided from May 17, 2020, to October 20, 2020. The calculated penalty was $215,124, which was capped at $100,000 per OCR’s 2019 notice of enforcement discretion.

“Patients should never be in the position of needing to request their own medical records over and over again before getting access to them,” said OCR Director Melanie Fontes Rainer. “Ensuring patients’ rights to timely access to medical information continues to be a HIPAA enforcement priority. Healthcare providers are legally obligated to provide patients with timely access to their medical records. If they fail to provide that access, OCR will not hesitate to do everything in its power, including imposing civil monetary penalties, to ensure compliance with the law.”

This was the 51st financial penalty imposed by OCR to resolve an alleged violation of the HIPAA Right of Access, and its 12th financial penalty of the year to resolve noncompliance with the HIPAA Rules.