Essex Residential Care, LLC, to pay $100,000 after failing to comply with HIPAA Right of Access

Today, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), announced a $100,000 civil monetary penalty against Essex Residential Care, LLC, doing business as Hackensack Meridian Health, West Caldwell Care Center (“Hackensack Meridian Health”), a skilled nursing facility that provides long-term care and rehabilitation services.  OCR investigated Hackensack Meridian Health under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule for failing to provide a patient’s personal representative with timely access to the patient’s medical records.  The HIPAA Privacy Rule is the federal law that establishes national standards to protect individuals’ medical records, sets limits and conditions on the uses and disclosures of protected health information, and gives individuals certain rights, including the right to timely access and obtain a copy of their health records.  Today’s action resolves a matter where patient records were not provided in a timely manner.

“A patient’s timely access to health records is paramount for medical care.  The Office for Civil Rights continues to receive complaints from individuals and personal representatives on behalf of individuals who do not receive timely access to their health records,” said OCR Director Melanie Fontes Rainer.  “OCR will continue to vigorously enforce this essential right to ensure compliance by health care facilities across the country.”

In May 2020, OCR received a complaint alleging that Hackensack Meridian Health failed to pro