The Office for Civil Rights (OCR) recently settled a tenth case under its right-to-access initiative with California-based Riverside Psychiatric Medical Group (RPMG), for $25,000.

Although a relatively small settlement in the amount paid, it shows that the OCR is taking patients’ requests for access to their medical records seriously, and that no complaint is too small to investigate and enforce.

In this case, the patient complained to the OCR in March of 2019 that she had made multiple requests for her records from her provider, but never received the records. Following the complaint, OCR provided technical assistance to RPMG and closed the case. However, when the patient still did not receive he records, the patient filed a second complaint with the OCR.

The OCR reopened its file (which is never a good thing after technical assistance and a closing of a case) and launched a subsequent investigation. That investigation found that RPMG’s failure to respond to the patient’s request was a potential violation of HIPAA.

In defense of the failure to provide the patient access to her records, RPMG alleged that it was not required to produce psychiatric records under HIPAA, which the OCR admitted is true. However, the OCR stated in its press release “[W]hile the HIPAA Rules do not require production of psychotherapy notes, they do require covered entities (1) to provide requestors a written explanation when it denies any records request in whole or in part, (which RPMG did not do), and (2) to provide the individual access to his or her medical records other than psychotherapy notes (and information compiled in reasonable anticipation of, or for use in, a civil, criminal or administrative action of proceeding).”

RPMG sent the patient all of her records, except for psychotherapy notes in October 2020.

If you haven’t figured it out yet, when the OCR said that patients’ access to their records was a priority for enforcement in 2020, this tenth case shows that it is serious, no matter how small the entity or the request. It is also clear that the OCR will only give you one chance for technical assistance. Tread carefully when responding to patients’ request for access to their records with these settlements as guidance.