Privacy & Information Security Law Blog

On January 15, 2025, the U.S. Department of Health and Human Services’ Office for Civil Rights (“OCR”) announced a settlement with a Florida health system, Memorial Healthcare System (“MHS”), for a violation of the HIPAA Privacy Rule. OCR’s investigation determined that MHS failed to provide an individual with timely access to the individual’s protected health information within 30 calendar days. The individual sent numerous requests via mail, phone and MHS’ patient portal, but did not receive access to his medical records until approximately nine months after making the initial request (i.e., after OCR opened its investigation into the matter). As a result, OCR imposed a civil monetary penalty of $60,000. This latest action is the 52^nd enforcement action by OCR pursuant to its HIPAA Right of Access Initiative.