Oregon Health & Science University on Monday released the following statement about the Office of Civil Rights decision:

“Oregon Health & Science University is committed to preserving the privacy of protected health information and firmly supports patients’ right to access their health information, as provided by the Health Insurance Portability and Accountability Act, or HIPAA. OHSU respects the Office for Civil Rights’ responsibility to enforce the act; however, we do not agree with OCR’s findings.

“Regrettably, the OCR elected to pursue sanctions against OHSU rather than exercise its power to hold the vendor, or Business Associate, directly liable. While we acknowledge our own responsibilities to patients under HIPAA, we remain frustrated by the mischaracterization of facts contained in OCR’s published notice. OHSU provided evidence supporting our request for factual corrections, but the OCR declined our request. OHSU also requested a meeting with OCR to better understand their reasoning and what we could have done differently, but the request for a meeting was also denied.

“The OCR missed an opportunity to hold a Business Associate directly liable when they violate HIPAA. As a result, OHSU and many other covered entities are left wondering where our HIPAA responsibilities and the responsibilities of our Business Associates begin and end.”

Background

OHSU previously hired a vendor to process requests for patients’ health information. As required by HIPAA, OHSU signed a Business Associate Agreement with this vendor. When OHSU received notice from the OCR about a patient’s complaint related to a request for their health information, we immediately investigated and took corrective action to ensure the vendor provided the requested health information. The vendor was responsible for the errors that led to this patient’s frustrating experience, and OHSU has ended our relationship with the vendor. OHSU has since hired a different vendor to process patient requests for health information and signed a Business Associate Agreement with that vendor. We remain committed to respecting and honoring our patients’ right of access and to meeting all our responsibilities under state and federal law. OHSU did not appeal the imposed penalty because of the cost and resources necessary for such an effort.