On January 3, 2023, the U.S. Department of Health and Human Services Office for Civil Rights (OCR) announced a settlement with Life Hope Labs, LLC regarding a potential violation of the HIPAA Privacy Right to Access. This is the 43rd case under the OCR's Health Insurance and Accountability Act of 1996 (HIPAA) Right to Access Initiative, whereby OCR seeks to improve the level of compliance under HIPAA to provide individuals with the opportunity to inspect or obtain a copy of their protected health information (PHI) or to direct a covered entity to transmit a copy of their PHI to a designated person or entity of the individual's choice.
Initial settlements under this law were generally with healthcare providers and hospitals, but the OCR is expanding its reach to laboratories, dental practices, and other covered entities who may have erroneously assumed in the past that they were off the government's radar for such actions. Independent laboratories in particular may be at risk for right-to-access violations. While laboratories have controls in place to protect PHI, some may not have processes in place to respond to patient requests for testing reports. Most settlements have come as a result of an initial complaint received by the OCR.
Covered entities, individuals, and other organizations need to understand that this requirement is different from the requirement to secure an authorization for disclosure, as it is written broadly and comes with specific requirements for covered entities. These covered entities need to ensure that there is a comprehensive privacy program with specific standard operating procedures that outline exactly what the entity must do in order to avoid complaints and settlements with the OCR.
OCR's guidance on the HIPAA right of access is available at: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
