Feds Fine Mental Health Clinic $100K in 2020 HIPAA Case

Federal regulators have fined a Los Angeles county mental health clinic $100,000 for failure to provide a patient with timely access to her requested health records. The patient’s initial request came on the eve of California’s COVID-19 pandemic lockdown.

See Also: Enterprise Browser Supporting Healthcare, Cyber Resilience

The case against Rio Hondo Community Mental Health Center – which is operated by the Los Angeles County Department of Mental Health – is the U.S. Department of Health and Human Services’ Office for Civil Rights’ 51st enforcement action in a dispute involving the HIPAA right-of-access provision.

HHS OCR launched its right of access initiative as a top HIPAA enforcement priority in Apr. 2019, during Donald Trump’s first presidential administration.

“This latest settlement underscores that HHS OCR is taking HIPAA and patient rights seriously,” said regulatory attorney Rachel Rose, who is not involved in the Rio Hondo case.

“A way to ensure compliance is to incorporate HIPAA privacy rule requirements into the annual risk analysis and correct any gaps. Also, looking at appropriate and compliant business associates is another way to have the patient get their records in a timely manner,” she said.

HHS OCR in a statement Tuesday said the case against Rio Hondo centered on a complaint from a patient in Aug. 2020, alleging the mental health clinic had not provided her with her medical records after multiple requests in writing, in person and by phone.

The patient made her initial request in person at Rio Hondo on Mar. 18, 2020, by completing a paper medical records request form.

The next day, on Mar. 19, 2020, California Governor Gavin Newsom issued a “stay-at-home” order aimed at slowing the spread of COVID-19. From that day, until sometime in May 2020, Rio Hondo were not physically working at the facility.

After subsequent visits and multiple phone calls to Rio Hondo over seven months, the clinic finally provided the patient with her requested medical records in Oct. 2020 – after HHS OCR had notified the clinic that the agency was investigating the patient’s complaint.

“Based on the facts, OCR found that Rio Hondo failed to take timely action in response to the patient’s right of access in accordance with the HIPAA Privacy Rule,” HHS OCR said.

HHS OCR said it issued a Notice of Proposed Determination in Jul. 2024 to impose a $100,000 civil monetary penalty. Rio Hondo waived its right to a hearing and did not contest HHS OCR’s findings, the agency said.

“Patients should never be in the position of needing to request their own medical records over and over again before getting access to them,” said OCR Director Melanie Fontes Rainer.

“Ensuring patients’ rights to timely access to medical information continues to be a HIPAA enforcement priority. Healthcare providers are legally obligated to provide patients with timely access to their medical records,” she said. “If they fail to provide that access, OCR will not hesitate to do everything in its power, including imposing civil monetary penalties, to ensure compliance with the law.”

The Los Angeles County Department of Mental Health, in a statement to Information Security Media Group, said it is committed to ensuring clients have timely access to their medical records and has taken measures to ensure it remains in compliance with HIPAA standards.

“In response to this incident, our department has taken corrective action to ensure that all requests receive a response within a 30-day timeframe. This includes training staff involved with receiving and processing these requests and holding weekly meetings to discuss their statuses.”

No Excuses

Rose said that Rio Hondo’s failure to provide the patient with timely access to her requested records during the COVID-19 shutdown might have contributed to the delay, but it is not a valid excuse.

“There is no doubt that HHS-OCR factored that in. The number of excuses and delays went on far beyond the initial stages of COVID, which is what OCR detailed in its basis for the CMP,” she said.

Will HIPAA’s right-to-access enforcement continue to be a priority for HHS OCR under new leadership when Trump administration’s takes over in January?

“There is a lot of bipartisan support for cybersecurity and privacy and security of sensitive data in general,” Rose said.

“Every administration since George W. Bush has issued executive orders on cybersecurity and the HIPAA Privacy Rule has been in full swing for a while and transcended across more than one administration,” she said.

“While it is impossible to predict, patient privacy is an area that has continued to have a lot of focus.”