Right of access of individuals to PHI is another regulation under HIPAA that has not gotten a lot of attention until this year. Under 45 CFR ยง 164.524, “an individual has a right of access to inspect and obtain a copy of protected health information about the individual.” Earlier this week, OCR announced its first enforcement action and settlement in its Right of Access Initiative wherein Bayfront Health St. Petersburg paid $85,000 to OCR and adopted a corrective action plan to settle a potential HIPAA violation after Bayfront failed to provide a mother timely access to records about her unborn child. In most cases, HIPAA requires covered entities to provide such information within 30 days of request and may only charge a “reasonable, cost-based fee.”
See below for a link to the official press release:
https://www.hhs.gov/about/news/2019/09/09/ocr-settles-first-case-hipaa-right-access-initiative.html