Xavier Becerra United States Secretary of Health and Human Services | Official Website
The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) has announced a civil monetary penalty of $115,200 against American Medical Response (AMR), a provider of emergency medical services across the United States. The penalty follows an investigation based on a complaint that AMR failed to provide a patient with timely access to their medical records.
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule’s right of access provisions require that individuals or their personal representatives have timely access to their health information within 30 days, with the possibility of one 30-day extension, and for a reasonable, cost-based fee.
“HIPAA gives patients a right to timely access to their medical records,” said OCR Director Melanie Fontes Rainer. “OCR will continue to enforce this right through investigations, and when necessary, by imposing civil money penalties.”
OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules. These rules set forth requirements that covered entities such as health plans, healthcare clearinghouses, most healthcare providers, and business associates must follow concerning the privacy and security of protected health information. The HIPAA Privacy Rule establishes national standards to protect individuals’ medical records, sets limits on the uses and disclosures of protected health information, and grants individuals certain rights including timely access to obtain copies of their health records.
A complaint received by OCR alleged that AMR failed to provide a patient with timely access to their medical records after numerous attempts by the patient. Following an investigation by OCR, it was found that AMR had indeed failed in this regard. In response, AMR sent the requested records to the patient and amended its internal procedures to better track right-of-access requests in compliance with the law.
In October 2023, OCR issued a Notice of Proposed Determination seeking to impose a civil money penalty. AMR waived its right to a hearing and did not contest OCR’s findings. Consequently, OCR finalized its determination and imposed the civil money penalty against AMR.
View the Notice of Proposed Determination and Notice of Final Determination.
Read about OCR’s guidance on the HIPAA right of access.
OCR remains committed to enforcing HIPAA Rules designed to protect the privacy and security of people's health information. Guidance about the Privacy Rule, Security Rule, and Breach Notification Rule is available on OCR’s website.
If you believe your or another person’s health information privacy or civil rights have been violated, you can file a complaint with OCR.