LT 5? ?ll ?It: ?55 5 ?a is?! DEPARTMENT OF HEALTH a mom ssawcss OFFICE OF THE SECRETARY .- e? Voice - (212)264-3313. (soc) 363-1019 Of?ce for Civil Rights, Region 11 team, TDD - (212} 264-2355 Jacob Javits Federal Building (Faxi- (212)254-3ch . as Federal Plaza, Suite 3312 Emma? New York, NY 10273 {bi'tSiiblti'itCi (DC-I 6 .1312 OCR Transaction Number: 12-149420 {blt?ttbi?'iiCI Dear On September 2012, the us. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), Region It received your complaint alleging that New York Presbyterian Hospital (the covered entity) has violated the Federal Standards for Privacy of Individually Identi?able Health information (45 C.F.R. Parts 160 and 164. Subparts A and E. the Privacy Rule). Speci?cally, you allege that New York Presbyterian Hospital denied you a copy of your and your son's medical records despite several requests. This allegation could re?ect a violation of 45 C.F.R. 154.524. Thank you for bringing this matter to attention. Your complaint plays an integral part in OCR's enforcement efforts. OCR enforces the Privacy. Security, and Breach Noti?cation Rules, and also enforces Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sex and religion. OCR noti?ed the covered entity of your complaint and it agreed to take steps to resolve the issues in the case using the accelerated case resolution procedures. On October 12, 2012 you informed an OCR staff member that New York Presbyterian Hospital provided you with a copy of the requested records. As such, OCR has determined that the issues you raised in your complaint are now resolved. Shouid OCR receive a similar allegation of_noncompliance against New York Presbyterian Hospital in the future, OCR may initiate a formal investigation of that matter. Based on the foregoing, OCR is closing this case without further action, effective the date of this letter. OCR's determination as stated in this letter applies only to the allegations In this complaint that were reviewed by OCR. The Privacy Rule generally provides that individuals have the right to review and obtain a copy of their protected health information in a covered entity's designated record set. The "designated record set" is that group of records maintained by or for a covered entity that is used, in whole or in part, to make decisions about individuais, or that is a Page 2 provider's medical and billing records about individuals or a health plan?s enrollment, payment, claims adjudication, and case or medical management record systems. For information included within the right of access, covered entities may deny an individual access in certain speci?ed situations, such as when a health care professional believes access could cause harm to the individual or another. In such situations, the individual must be given the right to have such denials reviewed by a licensed health care professional for a second opinion. Additionally, covered entities may impose reasonable, cost-based fees for the cost of copying and postage. Please note, OCR is committed to educating consumers on their access rights. To that end, we encourage you to visit our website at and review the information provided with respect to "Health information Privacy.? Additionally, we have enclosed a document entitled ?Individuals Right to Access Medical Records? which discusses common frequently asked questions. Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives such a request, we will make every effort, as permitted by law, to protect information that identi?es individuals or that, if released, could constitute a clearly unwarranted invasion of personal privacy. If you have any questions regarding this matter, please'contact Lisa Lee Anderson, Investigator, at (212) 264-2078. Since ly. .464: a: mole C. Colon Regional Manager Of?ce for Civil Rights Region II Enclosures: Individuals Right to Access iini'ltts '31 D. DEPARTMENT OF HEALTH 3: Honor: SERWCES OFFICE on THE SECRETARY Voice . (212) 264-3313, (soc) 363-1019 Of?ce for Civil Rights, Region II me - {212) 264-2355 Jacob Javits Federal Building (FAX) - (2?12) 254-3039 26 Federal Plaza, Suite 3312 goviocri New York, NY 10278 ltbit?it?iifitci New York Presbyterian Hospital Of?ce of Legal Affirs and Risk Management 525 East 65 Street New York. New York 10021 OCR Transaction Number: 12449420 Dear {bitEiitbiETitCi On September 2012, the US. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), Region II received a complaint alleging that New York Presbyterian Hospital (the covered entity) has violated the Federal Standards for Privacy of Individually identi?able Health lnfonnation (45 C.F.R. Parts 160 and 164. Subparts A and E, the Privacy Rule). Speci?cally, Iibii?i'ibiifiici Ithe complainants, allege that they were denied a copy of her and their son's medical records despite several requests. This allegation could reflect a violation of 45 C.F.R. 164.524. OCR enforces the Privacy, Security. and Breach Notification Rules, and aiso enforces Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sex and religion. OCR thanks you for your voluntary comptianoe in the matter by providing the complainant with a copy of the requested records on October 12, 2012- As a result oi your voluntary compliance. OCR considers the matter raised by this complaint as now being resolved. Based on the foregoing, OCR is closing this case without further action, effective the date of this letter. The Privacy Rule generally provides that individuals have the right to inspect and obtain a copy of their protected health information (PHI) in a covered entity?s designated record set. The "designated record set? is that group of records maintained by or for a covered entity that is used, in whole or part. to make decisions about individuals, or that is a provider's medical and biiling records about individuais or a heatth pian's enrollment, payment, claims adjudication, and case or medical management record systems. The h' ti Page 2 It it it who I Rule excepts from the right of access the following protected health information: notes, information compiled in reasonable anticipation of legal proceedings, laboratory results to which the Clinical Laboratory improvement Act (CLIA) prohibits access, or information held by certain research laboratories. While covered entities may require requests to be in writing, provided the individual is informed of the requirement, generally, the covered entity must act on a request for access no later than 30 days of receipt of the request. If the covered entity is not able to act on the request in a timely manner, the covered entity must notify the individual in writing within the 30 days of the reason for the delay and the date by which the covered entity will complete its action on the request. The covered entity may charge reasonable, cost-based fees for copying PHI it costs are tirnited to copying (inciuding cost of supplies and labor), postage where applicable and cost or preparing an explanation or summary, if agreed to by the individual. Covered entities may not deny access based on an individual?s failure to pay a debt and covered entities may not require the payment of past due balances as a condition for access. Further, to assist you in ensuring compliance in the future, OCR has enclosed material explaining the Privacy Rule provisions related to an Individual's Access to Medical Records. You are encouraged to review these materials closely and to share them with your staff as part of the Health Insurance Portability and Accountability Act (HIPAA) training you provide to your workforce. You are also encouraged to assess and determine whether there may have been an incident of noncompliance as atleged by the complainant in this matter, and, if so, to take the steps necessary to ensure such noncompliance does not occur in the future. Please contact OCR if you need further information regarding the allegations in this matter. Should OCR receive a similar allegation of noncompliance against your of?ce in the future, OCR may initiate a format investigation of that matter. determination as stated in this letter applies only to the allegations in this complaint that were reviewed by OCR. Under the Freedom of Information Act, we may be required to release this letter and other infon'naticn about this case upon request by the public. In the event OCR receives such a request, we will make every effort, as permitted by law, to protect information that identi?es individuals or that, if released, could constitute a clearty unwarranted invasion of personal privacy. Page 3 If you have any questions regarding this matter, please contact Lisa Lee Anderson, Invesligator, at (212) 264-2078. . Sincer?iy??adcf a C. Colon Regional Manager Office for Civil Rights Region Ii Enclosures: Individuals Right to Access Medical Records