The $200,000 civil monetary penalty [paid by Oregon Health & Science University (“OHSU”) for failing to provide requested medical records shows health care providers, health plans and insurers, and health care clearinghouses (“covered entities”) the perils of violating an individual’s Health Insurance Portability & Accountability Act of 1996 (“HIPAA”) right to timely access. As the 53rd Department of Health and Human Services Office of Civil Rights (“OCR”) announced HIPAA right of action enforcement action, the penalty reaffirms OCR’s continued strong commitment to the enforcement of HIPAA rights of access against covered entities and demonstrates the potential high cost covered entities can face for noncompliance with these requirements. Like the 52 prior enforcement actions, the OHSU penalty warns health plans and other covered entities to confirm their compliance to avoid incurring similar liabilities.
Thie HIPAA Privacy Rule’s ”Right of Access” provisions require covered entities give requesting individuals or their personal representatives with timely access to requested protected health information. Generally, this means the covered entity must provide protected health information access within 30 days, with the possibility of one 30-day extension if certain requirements are met. HIPAA also prohibits covered entities from charging more than a reasonable, cost-based fee for this record access. This requirement is in addition to any otherwise applicable duty to provide timely access to records imposed by otherwise applicable laws such as rules applicable to health plans and health insurers covered by the adverse benefit determination rules of the Patient Protection and Affordable Care Act (“ACA”) or the Employee Retirement Income Security Act of 1974 (“ERISA”) or health insurers or health care providers under applicable state medical privacy and records laws state insurance laws, and health care providers under applicable state medical practice laws The Privacy Rule also contains specific rules for determining the allowable fees, which typically are more restrictive than often concurrently applicable state laws applicable to health care providers or insurers.
Covered entities also should recognize that covered entities violating the right of access rule face a high likelihood of enforcement by OCR. Patients and other individuals and their personal representatives typically are well informed about their access rights due to HIPAA’s notice of privacy practices and posting requirements. Since right of access violations are one of the most common complaints and OCR frequently finds violations when investigating these complaints,
The $200,000 civil monetary penalty against OHSU along with the undisclosed legal fees and other expenses it incurred in responding to the investigation and enforcement action show the HIPAA liability covered entities can incur for violating the right of assess rule. In September 2024, OCR issued a Notice of Proposed Determination seeking to impose a $200,000 civil monetary penalty. OHSU waived its right to a hearing and did not contest OCR’s imposition of a civil monetary penalty. Accordingly, in December 2024, OCR imposed the $200,000 civil monetary penalty against OHSU in a December 2024 Notice of Final Determination. The OHSU civil monetary penalty arose from OCR’s investigation of a second complaint filed by an individual’s personal representative in January 2021 from the individual’s personal representative. The complaint was one of two OCR received on this matter. In September 2020, OCR resolved the first complaint received in May 2020 after OCR notified OHSU of its potential noncompliance with the Privacy Rule Right of Access provisions. Although OHSU provided part of the requested records in April 2019, OHSU did not provide all of the requested records in August 2021. This was 16 months after the first request for records in April 2019 and nearly a year after OCR previously warned OHSU about its HIPAA obligations in response to the initial complaint. Based on these findings, OCR determined OHSU violated the right of access rule by failing to take timely action in response to the right of access requests.
Along with showing the importance of overall timely compliance with the right of access rule, the OHSU civil monetary penalty also shows covered entities the importance of promptly and completely correcting any violation and their causes that results in a failure by the covered entity (including an employee or business associate responsible for responding to requests) has violated the right of access rule. OCR’s right of access rule investigation and enforcement history against covered entities, including the original complaint against OHSU, demonstrates that OCR seeks settlement with substantially smaller or even no financial payment required if the covered entity promptly and completely fixes the violation in response to OCR’s notice and technical assistance.
The author of this update, Cynthia Marcotte Stamer is an American College of Employee Benefits Counsel Fellow and attorney board certified in Labor and Employment Law by the Texas Board of Legal Specialization, nationally known and celebrated for her experience providing advice and representation on HIPAA and other risk management and compliance to employers and other health plan sponsors, health plans, health plan fiduciaries and administrators, health and other insurers, third party administrators, health care and other managed care providers and organizations, human resources and health plan technology, and other businesses about health plan design, administration, and other compliance, risk management and operational matters. If you have questions or need advice or help evaluating or addressing these or other compliance, risk management, or other concerns, contact her.
For More Information
We hope this update is helpful. For more information about these or other health or other employee benefits, human resources, or health care developments, please contact the author, Cynthia Marcotte Stamer, via e-mail or telephone at (214) 452-8297.
Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.
About the Author
A Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation; Cynthia Marcotte Stamer is an attorney board certified in labor and employment law by the Texas Board of Legal Specialization, management consultant, author, public policy advocate and lecturer sought out by clients and industry and government leaders for her more than 35 years of health, insurance, employment and employee benefits and other industry management work, thought leadership, public policy and regulatory affairs advocacy, coaching, teaching, and publications on health and other employee benefits, health care, insurance, workforce and other risk management and compliance.
Along with her decades of legal and strategic consulting experience, Ms. Stamer also contributes her leadership and experience to many professional, civic and community organizations. Along with currently serving as Co-Chair of the ABA Real Property Trusts and Estates (“RPTE”) Section Welfare Plan Committee, Co-Chair of the ABA International Section International Employment Law Committee and its Annual Meeting Program Planning Committee, Chair Emeritus and Vice Chair of the ABA Tort Trial and Insurance (“TIPS”) Section Medicine and Law Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, her previous ABA leadership roles include more than a decade of service as a Scribe for the Joint Committee on Employee Benefits (“JCEB”) annual agency meetings with the Department of Health and Human Services and JCEB Council Representative, International Section Life Sciences Committee Chair, RPTE Section Employee Benefits Group Chair and a Substantive Groups Committee Member, Health Law Section Managed Care & Insurance Interest Group Chair, as TIPS Section Medicine and Law Committee Chair and Employee Benefits Committee and Workers Compensation Committee Vice Chair, Tax Section Fringe Benefit Committee Chair, and in various other ABA leadership capacities. Ms. Stamer also is a former Southwest Benefits Association Board Member and Continuing Education Chair, SHRM National Consultant Board Chair and Region IV Chair, Dallas Bar Association Employee Benefits Committee Chair, former Texas Association of Business State, Regional and Dallas Chapter Chair, a founding board member and Past President of the Alliance for Healthcare Excellence, as well as in the leadership of many other professional, civic and community organizations. She also is recognized for her contributions to strengthening health care policy and charitable and community service resolving health care challenges performed under PROJECT COPE Coalition For Patient Empowerment initiative and many other pro bono service involvements locally, nationally and internationally.
Ms. Stamer is the author of many highly regarded works published by leading professional and business publishers, the ABA, the American Health Lawyers Association, and others. Ms. Stamer also frequently speaks and serves on the faculty and steering committee for many ABA and other professional and industry conferences and conducts leadership and industry training for a wide range of organizations.
For more information about Ms. Stamer or her health industry and other experience and involvements, see http://www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.
About Solutions Law Press™
Solutions Law Press™ provides health care, insurance, human resources and employee benefit, data and technology, regulatory and operational performance, and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education. These include extensive resources on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press™ resources or training.
If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.
NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstances at the particular time. No comment or statement in this publication is to be construed as legal advice or an admission. Solutions Law Press and its authors reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often rapidly evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. Solutions Law Press and its authors disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law-specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.
Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.
©2025 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press.™ For information about licensing for republication, please contact the author directly. All other rights reserved
Posted by Cynthia Marcotte Stamer 