MA health network to pay $70,000 after failing to provide medical records

The U.S. Department of Health and Human Services’ Office of Civil Rights announced this week that five providers had agreed to pay settlements for potential violations of the HIPAA Privacy Rule’s right of access provision.

Beth Israel Lahey Health Behavioral Services’ settlement was the largest of the group, with the Massachusetts-based network of mental health and substance use disorder services agreeing to pay OCR $70,000 and to adopt a corrective action plan. 

The other settlements ranged from $3,500 to $38,000. They come as part of the OCR’s ramped-up intention to “vigorously enforce” the rights of patients to access their records in a timely fashion without being overcharged.

The announcement, said OCR Director Roger Severino in a statement, “is about empowering patients and holding health care providers accountable for failing to take their HIPAA obligations seriously enough.”


In 2019, OCR announced the Right of Access Initiative as an enforcement priority. Since then, it has completed seven enforcement actions, including the five this week.

According to the agency, OCR received a complaint in April 2019 alleging that Beth Israel Lahey Health Behavioral Services had failed to respond to a request two months prior from an individual seeking her father’s