Arizona health care system pays $200K to settle potential HIPAA violations

Phoenix — Banner Health agreed to take corrective actions and pay $200,000 to settle potential violations of the HIPAA Privacy Rule’s right of access requirement when it allegedly failed to provide timely access to a patient’s requested medical records.

The Office for Civil Rights at the U.S. Department of Health and Human Services announced in a Jan. 12 news release that it was the 14th settlement of an enforcement action in its HIPAA Right of Access Initiative.

The office announced this initiative as an enforcement priority in 2019 to support individuals’ right to timely access of their health records at a reasonable cost under the HIPAA Privacy Rule.

Banner Health is a nonprofit health system based in Phoenix, Arizona, that operates 30 hospitals and numerous primary care, urgent care and specialty care facilities.

The Office of Civil Rights received two complaints filed against Banner alleging violations of the HIPAA Right of Access standard.

The first complaint alleged that an individual requested access to her medical records in December 2017 and did not receive the records until May 2018, according to the release.

The second complaint alleged that an individual requested access to an electronic copy of his records in September 2019, and the records were not sent until February 2020.

“This first resolution of the year signals that our Right of Access Initiative is still going strong and that providers of all sizes need to respect the right of patients to have timely access to their medical records,” said Office of Civil Rights Director Roger Severino in the release.