Failure to Timely Provide Access to Health Records is Costly

The U.S. Department of Health and Human Services, Office for Civil Rights recently issued penalties relating to two separate investigations based on complaints that a health care provider failed to timely provide the patient with access to the patient’s healthcare records as required by HIPAA. On October 17, 2025, the OCR announced the imposition of a $70,000 civil monetary penalty against a Maryland dental practice for the failure to timely provide a parent with copies of her children’s dental records. In this instance, the failure continued for more than two years after the initial records request. OCR was unpersuaded by the dental provider’s argument that the reason for the failure to timely provide the records was due to the parent’s refusal to pay the $25 records fee and because the provider believed the parent would use the records to commit insurance fraud. The civil monetary penalty marks the OCR’s 50th “Right of Access” enforcement action.

On November 19, 2024, the OCR announced its 51st “Right of Action” enforcement action. In this instance, the OCR imposed a $100,000 civil monetary penalty against a California mental health center for its failure to timely provide healthcare records to an individual. In this instance, records were provided 216 days after the individual’s initial request during the COVID-19 pandemic, which was followed by multiple other requests. OCR was unpersuaded by the provider’s argument that the failure to timely provide the records was due to changes in the provider’s infrastructure resulting from the pandemic and the state’s “Safer at Home” order.

Both enforcement actions highlight:

• HIPAA’s strict requirement to provide individuals with access to their healthcare records within the timeframes set forth in HIPAA. This means requests must be fulfilled within 30 calendar days, which may be extended one time per request for an additional 30 calendar days if the provider notifies the individual in writing within the initial 30 days that there will be a delay and provides the reason for the delay.

• OCR’s hard-line stance on HIPAA’s right of access rule.

Click Here to read the entire November 2024 Healthcare Law Update now!