An official website of the United States government
Here’s how you know
Official websites use .gov A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS A lock () or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
HHS’ Office for Civil Rights Settles Multiple HIPAA Complaints With Optum Medical Care Over Patient Access to Records
This Settlement Marks the 46th Enforcement Action in the OCR Right of Access Initiative
Today, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), announced a settlement with Optum Medical Care of New Jersey (formerly known as Riverside Medical Group and Riverside Pediatric Group). Optum Medical Care is a multi-specialty physician group serving patients throughout New Jersey and Southern Connecticut. The settlement resolves multiple complaints filed with OCR concerning potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule’s Right of Access provision. The HIPAA Right of Access provision requires that individuals or their personal representatives have timely access to their health information for a reasonable cost. OCR’s investigation revealed that Optum failed to provide access within 30 calendar days. Optum has agreed to implement a corrective action plan to ensure timely access for patients to their records and pay $160,000 to resolve this matter. The agreement marks OCR’s 46th Right of Access enforcement action.
“Health care providers must make responding to parents’ or patients’ request for access to their medical records in a timely manner a priority,” said OCR Director Melanie Fontes Rainer. “Access to medical records is a fundamental right under HIPAA, and one for which OCR receives thousands of complaints each year. This is the law—providers must proactively respond to record requests and ensure timely access. Access to medical records empowers patients and their families to make decisions about their health care and improve their health overall. It is critical that providers follow the law.”
In Fall 2021, OCR received six complaints alleging that Optum Medical Care failed to provide copies of medical records requested by an adult patient or by the parents of minor patients. In February 2022, OCR initiated investigations of these Right of Access complaints. The complaints disclosed that patients received their requested records between 84 and 231 days after their respective requests were submitted. Those timeframes are well outside of the HIPAA Right of Access requirement that providers must give access to medical records requested no later than 30 calendar days from receiving the individual's request. OCR’s investigation determined that Optum Medical Care’s failure to provide timely access to the requested medical records was a potential violation of HIPAA.
In addition to paying $160,000 to OCR, Optum Medical Care will implement a corrective action plan that requires workforce training, reporting records requests to OCR, and reviewing and revising as necessary its right of access policies and procedures to provide timely responses to requests. Under the plan, OCR will monitor Optum Medical Care for one year.
OCR is committed to enforcing the privacy and security of people’s health information. If you believe that your or another person’s health information privacy or civil rights have been violated, you can file a complaint with OCR at: https://www.hhs.gov/ocr/complaints/index.html.
For general media inquiries, please contact media@hhs.gov.
Content created by Office for Civil Rights (OCR) Content last reviewed
Disclaimer Policy: Links with this icon () mean that you are leaving the HHS website.
The Department of Health and Human Services (HHS) cannot guarantee the accuracy of a non-federal website.
Linking to a non-federal website does not mean that HHS or its employees endorse the sponsors, information, or products presented on the website. HHS links outside of itself to provide you with further information.
You will be bound by the destination website's privacy policy and/or terms of service when you follow the link.
HHS is not responsible for Section 508 compliance (accessibility) on private websites.
For more information on HHS's web notification policies, see Website Disclaimers.