HIPAA's Right of Access: Compliance Challenges, OCR Enforcement, and Best Practices
Course Details
- smart_display Format
On-Demand
- signal_cellular_alt Difficulty Level
- work Practice Area
Health
- event Date
Wednesday, June 22, 2022
- schedule Time
1:00 p.m. ET./10:00 a.m. PT
- timer Program Length
90 minutes
-
This 90-minute webinar is eligible in most states for 1.5 CLE credits.
-
This CLE course will guide healthcare counsel on HIPAA's right of access. The panel will discuss defining the designated record set and evaluate common scenarios in which liability may arise. The panel will also discuss the U.S. Department of Health and Human Services Office for Civil Rights (OCR's) right of access enforcement efforts. The panel will offer best practices for compliance.
Ms. Montague represents a variety of health care providers, digital health companies, senior living facilities, nonprofit trade associations, life sciences companies, and vendors of health care providers. She is a Certified Information Privacy Professional/United States (CIPP/US), the preeminent credential in the field of privacy. Ms. Montague assists health care providers and business associates of all types in complying with the requirements of HIPAA and the HITECH Act, from the development of policies and workforce training to analysis and notification of breaches to guidance through Office for Civil Rights investigations. She also advises vendors initiating arrangements with health care entities on whether their business triggers HIPAA. Beyond HIPAA, Ms. Montague counsels health care providers on compliance with other federal and state health information confidentiality requirements, as well as cybersecurity best practices.
In March 2022, OCR announced the resolution of three investigations related to HIPAA right of access compliance. The announcement, along with recent statements from the OCR director, emphasizes the ongoing focus by OCR on its Right of Access Initiative.
The HIPAA Privacy Rule generally requires HIPAA covered entities to provide individuals, upon request, with access to protected health information (PHI) about them maintained by/for the covered entity in "designated record sets." However, the HIPAA right of access may not apply to all PHI, as it is limited to information contained in the designated record set. Complying with the HIPAA access requirement, along with access requirements under other applicable laws, can be challenging for many entities.
Listen as our authoritative panel of healthcare attorneys examines HIPAA's right of access requirements. The panel will discuss compliance challenges and evaluate common scenarios that may give rise to liability. The panel will offer practical guidance for ensuring compliance with HIPAA's right of access requirements.
- HIPAA basics and the right of access
- HIPAA Right of Access Initiative
- Common scenarios in which liability may arise
- Intersection with the interoperability rule
- Applicable state law
- Record retention
- Best practices
The panel will review these and other relevant issues:
- What compliance challenges are covered entities facing today with respect to the HIPAA right to access?
- What steps should covered entities take to define designated record sets and otherwise ensure compliance with access requirements?
- Under its Right of Access Initiative, what actions has OCR taken to enforce the requirements?
Related Courses
Ambulatory Surgery Center Acquisitions: Minimizing Compliance Risks
Thursday, October 9, 2025
1:00 p.m. ET./10:00 a.m. PT
Hidden Risks of Boilerplate Clauses in Healthcare Contracts: Avoiding Unintended Consequences, Implementing Practical Solutions
Wednesday, October 29, 2025
1:00 p.m. ET./10:00 a.m. PT