Ensuring Compliance with HIPAA’s Right of Access: Lessons from OHSU’s $200,000 Penalty 

The Cost of Noncompliance: A Warning for Healthcare Providers 

The recent $200,000 civil monetary penalty imposed on Oregon Health & Science University (OHSU) serves as a stark reminder of the serious consequences of failing to comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Right of Access provisions. The enforcement action, announced by the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR), marks the 53rd such case and underscores the agency’s continued commitment to ensuring that patients have timely access to their medical records. 

Healthcare providers, health plans, and other covered entities must recognize that failure to meet HIPAA’s strict requirements can result in significant financial penalties, legal fees, reputational damage, and loss of patient trust. What are the key takeaways from the OHSU case, and how can providers leverage actionable insights to enhance compliance? 

Understanding HIPAA’s Right of Access 

The HIPAA Privacy Rule guarantees individuals the right to access their protected health information (PHI) within 30 days of a request, with an option for a 30-day extension under specific circumstances. Covered entities are also restricted to charging only reasonable, cost-based fees for providing records. 

This right is crucial for empowering patients to manage their healthcare, make informed decisions, and ensure continuity of care. Yet, many covered entities struggle to meet these obligations, often due to administrative inefficiencies, outdated systems, or a lack of clear internal processes. 

The OHSU Case: A Timeline of Violations 

The OHSU case provides a textbook example of what not to do when handling patient record requests: 

• April 2019: The initial request for records was submitted, and only partial records were provided within five days. 

• May 2020: A second request was submitted, prompting OCR to issue a compliance warning. 

• August 2021: Despite multiple follow-ups and an official warning from OCR, OHSU failed to provide the remaining requested records until this date—16 months after the first request. 

• September 2024: OCR issued a Notice of Proposed Determination, seeking to impose a $200,000 penalty. 

• December 2024: OHSU waived its right to a hearing and accepted the penalty without contesting the charges. 

The lengthy delay in fulfilling the request led OCR to determine that OHSU had violated HIPAA’s Right of Access provisions by failing to take timely and appropriate action. 

The Broader Implications for Covered Entities 

OHSU’s penalty is not an isolated case. Over 50 similar enforcement actions have been taken in recent years, highlighting a growing regulatory focus on patient access rights. Covered entities should take note of the following key lessons: 

• Delays Can Be Costly: The OHSU case demonstrates that delays in fulfilling record requests—whether intentional or due to administrative backlog—can lead to substantial penalties. 

• Corrective Action Matters: Organizations that quickly address violations upon OCR’s initial notification often face lower penalties or avoid financial penalties altogether. 

• Business Associates Are Not an Excuse: Even if a third-party vendor handles medical records, the responsibility for compliance ultimately falls on the covered entity. 

• Patients Are Well-Informed: With privacy notices and widespread awareness campaigns, patients and their representatives are increasingly knowledgeable about their rights and more likely to file complaints when their access requests are not met. 

The Regulatory Landscape: Why Compliance Matters More Than Ever 

HIPAA’s Right of Access has been a focal point for enforcement, but it is only one part of a broader regulatory push for patient empowerment. HHS has emphasized that timely access to medical records is essential for improving healthcare outcomes, reducing costs, and fostering patient engagement. 

Moreover, as healthcare becomes increasingly digital, compliance challenges are evolving. The rise of electronic health records (EHRs) and patient portals presents new opportunities to streamline compliance, but also introduces security and workflow complexities that must be managed effectively. 

With ongoing changes to HIPAA regulations and increasing penalties for noncompliance, covered entities must stay proactive in their approach to compliance. Ignoring the importance of access rights is no longer an option. 

Practical Steps to Ensure Compliance 

To avoid the financial and reputational risks associated with HIPAA violations, covered entities should implement the following best practices: 

1. Streamline Record Request Processes 

• Establish a dedicated team or individual responsible for handling record requests. 

• Implement electronic record request systems to expedite processing. 

• Develop clear, standardized policies for processing requests within the 30-day timeframe. 

2. Train Staff on HIPAA Requirements 

• Conduct regular training sessions to ensure all employees understand HIPAA’s Right of Access provisions. 

• Educate staff on how to handle record requests from personal representatives and legal guardians. 

• Emphasize the importance of timely response and compliance in all departments. 

3. Leverage Technology for Compliance 

• Use EHR systems that allow patients to request and access their records online. 

• Automate reminders and follow-ups for pending requests. 

• Implement audit trails to track access requests and responses. 

4. Establish a Compliance Monitoring System 

• Conduct periodic internal audits to assess adherence to HIPAA access rules. 

• Address compliance gaps proactively before they lead to enforcement actions. 

• Encourage a culture of transparency where employees can report potential HIPAA violations. 

The Need for Proactive Compliance 

The OHSU penalty is a wake-up call for all covered entities. Compliance with HIPAA’s Right of Access rule is not optional—it is a legal requirement that must be prioritized. By proactively implementing best practices, healthcare providers can not only avoid costly penalties but also enhance patient trust and streamline operations. 

As OCR continues to enforce access rights, covered entities must recognize that investing in compliance today will prevent costly enforcement actions tomorrow. With patient expectations rising and regulatory scrutiny increasing, there is no better time to strengthen HIPAA compliance than now.