CHS Fined in First HIPAA Right of Access Case

Dive Brief:

  • HHS’ enforcement arm, the Office for Civil Rights, settled its first case under its Right of Access Initiative.
  • A St. Petersburg, Florida-based trauma and tertiary care center, Bayfront Health St. Petersburg, paid $85,000 to OCR to settle claims it failed to provide a mother with timely access to her child’s prenatal health records, but it did not admit culpability. OCR will monitor Bayfront for one year to ensure ongoing compliance, and the hospital will undertake a corrective action plan.
  • The St. Petersburg center is part of a seven-hospital system, also called Bayfront Health, that was purchased in 2014 by Nashville-based Community Health Systems and transitioned into a for-profit chain.

Dive Insight:

The Right of Access Initiative, announced earlier this year, defends patients’ right to prompt and inexpensive access to their own health records under the Health Insurance Portability and Accountability Act. Currently, more than half of providers fail to fully comply with right of access, according to research published in medRxiv. Although the study was not peer reviewed, it provides some insight into the scope of the problem.

Patient access to records was among the top four issues for OCR HIPAA investigations from 2015 through 2018.

“We aim to hold the health care industry accountable for ignoring peoples’ rights to access their medical records and those of their kids,” OCR Director Roger Severino said in a statement Monday.

OCR began looking into Bayfront following an August 2018 complaint from a mother seeking access to prenatal health records for her child, which is also covered under the Right of Access if the child is a minor.

The mother alleged she requested her fetal heart monitor records from Bayfront starting in October 2017, but she hadn’t received them. Bayfront said it had no record of the mother’s request and, following two additional requests from the mother’s lawyer, provided the lawyer with an incomplete set of the fetal heart monitor records in March of last year and a full set of the records in August — more than nine months after they were initially requested.

Under HIPAA rules, providers have a maximum of 30 days to comply with those requests. There’s some evidence HHS is considering shortening that window but providers have pushed back against any potential changes, arguing cutting the time period will sharply increase their administrative burden.

Bayfront has agreed to take corrective action, including revising its written access policies and procedures to bring them into line with federal law, training staff annually, and sanctioning workers who fail to comply to ensure timely responses to patient record requests.

Bayfront is a 480-bed hospital with over 550 affiliated physicians and the only Level II adult and pediatric trauma center in Pinella Country — one of only 21 in the state of Florida.

The CHS-owned Florida health system has been plagued by top executive turnover and corporate restructuring in the first half of the year. In July, it hired a new CEO, Sharon Hayes, after the previous CEO resigned and laid off roughly 30 employees, or 2% of its total workforce.

Bayfront didn’t respond to a request for comment by time of publication.


Scroll to Top