Ridgewood, NJ-based Village Plastic Surgery has reached a HIPAA settlement agreement with the HHS’ Office for Civil Rights to resolve possible violations of the HIPAA Right of Access.
Village Plastic Surgery has agreed to hand over $30,000 penalty and implement a range of corrective measures linked to access to protected health information (PHI). OCR will also continue to police Village Plastic Surgery for compliance for the next 24 months.
A review was initiated into Village Plastic Surgery by OCR in the aftermath of a complaint being submitted by a patient of the clinic on September 7, 2019. The was connected to the fact that the patient had asked for a copy of the medical records stored by the plastic surgery clinic. However, this had not been been provided inside the the maximum time stated by the HIPAA Privacy Rule. In the subsequent review OCR discovered that the claim was corrent and Village Plastic Surgery had not supplied the patient with the requested records.
OCR discovered that the delay in handing over the records, which was more than the permitted thirty, was in excess of the time requirement stated in the HIPAA Right of Access, as detailed in 45 C.F.R. § 164.524. Due to the OCR review, the patient was supplied with a copy of the requested records. Village Plastic Surgery made no admission of liability in the final settlement.
Acting OCR Director Robinsue Frohboese said, in relation to the case: “OCR’s Right of Access Initiative continues to support and enforce individuals’ vital right to receive copies of their medical records in a timely manner. Covered entities must comply with their HIPAA obligations and OCR will take appropriate remedial actions if they do not.”
This OCR action is the 18th financial penalty to be sanctioned by OCR in relation to breaches of the HIPAA Right of Access under its Right of Access enforcement initiative. This initiative was first begun at the end of 2019.