Header graphic for print
HealtHITech Law HIPAA, HITECH and Beyond


Posted in Enforcement

Health care providers and health plans should expect an increase in patient requests for their own health care information as OCR continues to emphasize the HIPAA right of access.

On May 31, 2012, Leon Rodriguez, Director of OCR, issued a memorandum regarding patients’ fundamental right to access their own health care information.  See  hhs.gov/ocr/privacy/hipaa/understanding/consumers/righttoaccessmemo.pdf.  Director Rodriguez, citing a lack of consumer knowledge about their rights as the primary barrier to getting their health information, instructed health care consumers to do the following:

  • Ask to see and get a copy of your health records from most doctors, hospitals, and other health care providers such as pharmacies and nursing homes, as well as from your health plan; and
  • Get the copy of your record in the way that you want – such as an electronic copy or a paper copy – if your plan or provider is able to do so.

Finally, Director Rodriguez stated that consumers should “review carefully the Notice of Privacy Practices that you get from your health care providers and health plans” and “[i]f you don’t have a copy, you can always ask your doctor or health plan to give you one.”

Although the final HITECH rules have not been issued yet, OCR has made it clear that a consumer’s right to access their own health information is a fundamental right under HIPAA which will not be altered.  Further, as OCR continues to educate health care consumers regarding this right, health care providers and health plans must be prepared to timely and fully respond to such consumer requests.  Otherwise, like Cignet in February 2011 (a health care provider which was fined $4.3 million dollars for denying 41 patients access to their health care information), health care providers and health care plans risk being subject to significant civil monetary penalties for failing to comply with this fundamental right to access.