By Matt Fisher, Healthcare Attorney
LinkedIn: Matthew Fisher
X: @matt_r_fisher
Host of Healthcare de Jure – #HCdeJure
The HHS Office for Civil Rights continues to pursue enforcement actions when alleged non-compliance occurs following a right of access request. Not every settlement provides the same degree of insight or ability to follow OCR’s line of thinking though. That is the case stemming from the latest civil monetary penalty announced by OCR.
Rio Hondo CMP
On November 19, 2024, the OCR released both the Notice of Proposed Determination and the Notice of Final Determination sent to Rio Hondo Community Mental Health Center (Rio Hondo). For a quick background, Rio Hondo is an outpatient mental health center operated by the County of Los Angeles Department of Mental Health (LADMH). Rio Hondo is a covered entity as defined by HIPAA, but not all of LADMH meets the definition. Accordingly, OCR acknowledged that LADMH is a hybrid entity. Not necessarily an important fact in the imposition of the civil monetary penalty, but interesting and maybe a factor in the final fine that was imposed.
Getting back to the story, an individual went in person to Rio Hondo on March 18, 2020 to complete a request for access form. The form satisfied all requirements under the right of access portion of the Privacy Rule. Rio Hondo admitted that it received the request on March 18, 2020 and also does not dispute that the form satisfied applicable regulatory requirements.
The next day the world began to turn upside down though. The governor of California issued a stay at home order due to the advent of the COVID-19 pandemic. In May 2020, Rio Hondo were allowed to start returning to the facility and the right of access request was supposedly included in activities that resumed. To that point, Rio Hondo informed the requesting individual on May 22, 2020 by a telephone call that the records would be ready for pick up on May 27, 2020.
The requesting individual went to Rio Hondo on May 27, 2020 to get the records. After reportedly waiting for 20 minutes, the individual left contact information and asked to be contacted again when the records were actually ready. The Intermediate Typist Clerk (ITC) responding to the request subsequently told OCR that the ITC did not meet with the requesting individual because internal consultation was sought before responding to the request.
Adding some commentary, if internal consultation was needed, why was the requesting individual told to come to Rio Hondo on that day? That course of action suggests a bit of a runaround that would get someone frustrated. Related to the point of needing internal consultation, at no point is the specific nature of the records discussed. However, Rio Hondo provides mental health services. That begs the question of whether some part of the request involved psychotherapy notes that are exempt from the right of access and caused some confusion.
Turning again to the factual detail provided by OCR, the ITC reportedly tried to contact the requesting individual after she left, but apparently did not try that many times or even alert anyone higher up in Rio Hondo that the requested records were not provided. No records could be found of any further attempt to contact the requesting individual.
In the absence of getting the records, the requesting individual reached back out to Rio Honod on July 17, 2020 by phone multiple times. Rio Hondo admitted that the ITC received notification of the calls. However, no one at Rio Hondo could recall if follow up occurred. This same pattern reportedly continued throughout August 2020.
The requesting individual finally filed a complaint with OCR on August 21, 2020. After OCR notified Rio Hondo of the complaint, Rio Hondo kicked its response into higher gear. After leaving voicemails on October 7, 8, and 16, 2020, Rio Hondo told the requesting individual that the requested records were being sent by certified mail on October 20, 2020. The day before (October 19, 2020), Rio Hondo sent a letter of apology acknowledging the delay.
The factual detail removes any doubt that timely access was not provided. It also contains a number of admissions by Rio Hondo that it knew issues existed in how the response went.
Now the Questions
Despite the admissions of non-compliance, the time delay between the initial request and fulfillment is arguably not nearly as bad as many of the other right of access settlements announced by OCR. Despite the stay at home order necessitated by COVID-19, Rio Hondo did start some degree of contact in the 60 day range, which is not too bad given the outside circumstances. The breakdowns certainly appear to have started at that point, which did not help the situation.
In with those challenges and the filing of the complaint, Rio Hondo apparently took the investigation seriously because it provided the requested records in the same month that it learned of the investigation. Again, without the benefit of additional detail, Rio Hondo on the face of the recitations took quicker action and did not seek to further delay providing the records, which other entities settling right of access requests have done. Further, Rio Hondo interestingly provided a letter of apology, which is not a detail that can readily be recalled occurring in other instances.
While the non-compliance does not appear disputed, it also does not seem overly egregious when compared to other settlements. OCR still proceeded to push the envelope though and sought a civil monetary penalty at the maximum cap of $100,000 for the issue. Rio Hondo argued that it took reasonable actions to provide the records, but OCR did not count any of the statements as affirmative defenses that could factor into reducing the CMP.
After Rio Hondo declined the opportunity to appeal the proposed determination, COR finalized the CMP at the maximum amount of $100,000.
The final determination brings the somewhat more detailed story back to a couple of the most common questions about a HIPAA settlement: why the amount and why this instance. As noted, the reported conduct does not seem nearly as bad as a number of other similar cases. Some internal breakdown did happen at Rio Hondo that delayed the records being provided, but the facts also support an interpretation that some of the disconnect occurred between Rio Hondo and the requesting individual. Additionally, Rio Hondo promptly took action once it learned of the investigation, demonstrating that it did not try to play hardball with OCR.
Those types of actions often result in resolving an issue with technical guidance, not a settlement or a CMP. As is so often the case, a better explanation would be helpful. Did OCR feel a CMP could be imposed in this case because Rio Hondo is part of the LADMH and could afford to pay a somewhat substantial penalty? Were there other factors not reported that showed bad faith or some form of ill intent? That information would be helpful in driving compliance activities.
Waiting for the Next Settlement
While waiting for the next settlement, as usual, organizations should carefully examine internal practices. Organizations should also consider whether a policy or procedure is in place about how the organization will work with OCR if/when a complaint or investigation is commenced. Being responsive and cooperative is always a good idea. At the same time, organizations should also pay attention to internal operations and document contacts and other interactions with patients and others to enable painting a better picture. At the end of the day though, it is still a great mystery when OCR will seek a penalty or settlement and impose payment obligations.
This article was originally published on The Pulse blog and is republished here with permission.