Sharp HealthCare Agrees to Pay $70,000, Take Corrective Action to Settle Potential HIPAA Violation

The agreement stems from a series of potential violations that occurred in 2019, when a complaint was filed with OCR alleging that Sharp HealthCare failed to provide an individual with electronic access to his medical records.

A version of this article was first published February 16, 2021, by HCPro's Revenue Cycle Advisor, a sibling publication to HealthLeaders.

Sharp HealthCare, a regional healthcare group based out of San Diego, agreed to take corrective action and pay $70,000 to settle a potential violation of the HIPAA right of access standard, according to its resolution agreement with the Office for Civil Rights (OCR).

OCR announced the settlement February 12, its 16th settlement of an enforcement action in the HIPAA Right of Access Initiative.

The agreement stems from a series of potential violations that occurred in 2019, when a complaint was filed with OCR alleging that Sharp HealthCare failed to provide an individual with electronic access to his medical records. The complaint was initially filed June 11, 2019, more than two months after the request for records had been submitted. OCR closed the case by providing technical assistance to Sharp HealthCare, but a second complaint was filed by the individual on August 19, 2019. Sharp HealthCare did not provide the individual with the requested records until October 15, 2019, according to the resolution agreement.

In addition to paying $70,000 to OCR, Sharp HealthCare agreed to take numerous corrective action steps, including revised policies and procedures to be submitted to HHS within 60 days for final approval. Upon approval, Sharp HealthCare must distribute the policies and procedures to all appropriate employees within 60 days.

Sharp HealthCare must also submit an Implementation Report to OCR attesting that approved policies and procedures have been distributed to all necessary workforce members. The Implementation Report must also include all training materials used and a description of the training program, including a summary of the topics covered and the length of the training sessions. Finally, for the next six years Sharp HealthCare must file annual reports with OCR describing its training programs and policies and procedures, as well any violations of compliance with the updated policies and procedures.

The resolution agreement between OCR and Sharp Healthcare does not represent an admission of guilt.