Medical Records Online, Inc.

March 24, 2016Dear [redacted],This letter is in response to the Revdex.com complaint referenced in the subject line above.MRO provides healthcare organizations across the country with enterprise-wide solutions for secure, compliant and efficient exchange of Protected Health Information...

(PHI). These solutions include a suite of technology-driven PH disclosure management services comprised of Release of Information (ROI), government and commercial payer audit management, and accounting of disclosures.At MRO, we take customer complaints very seriously. When I received notice of this complaint, immediately gathered all of the information that I could about the complainant's interactions with MRO - his letters, emails, and phone calls. According to MRO's records, this complaint stems from a request that the complainant made to one our healthcare organization clients for copies of his medical records. Based on MRO's documentation, it appears that the complainant did not submit a request that was compliant with the Health Insurance Portability and Accountability Act (HIPAA). After receiving his initial request, MRO sent the complainant several communications and spoke with him numerous times on the phone to instruct him on how to submit a HIPAA-compliant request so that we could provide him with copies of his medical records. Based on my review of the facts at hand, the complainant's request was handled appropriately by MRO's customer service department.HIPAA has a number of requirements that must be met before copies of a patient's medical records can be disclosed. These requirements may seem arbitrary to some, but they are required under law and are important for protecting patient privacy. The complainant's initial request for copies of his medical records was not dated, which is required under 45 CFR 164.508(c)(1)(vi), so MRO sent him correspondence explaining the deficiency and instructing him on how to make his request HIPAA-compliant. The complainant then submitted an updated request; unfortunately, the request was missing information about where the copies of records should be sent to. 45 CFR 164.508(b)(3) does not permit the use of "compound authorizations" - all of the information that must be in the request under HIPAA must be contained in a single document, thus, we are not able to combine the complainant's first and second requests to make one HIPAA-compliant request. MRO sent him correspondence explaining the deficiency and instructing him on how to make his request HIPAA-compliant. In addition, several of MRO's customer service representatives spoke with the complainant and provided him with instructions on what was needed to correct the deficiency with his request. The complainant then provided MRO with another updated request that was HIPAA-compliant and we were then able to process his request and provide him with the requested copies of his medical records. I would be happy to provide you with copies of the correspondences that were sent to the complainant if they would be helpful in resolving this matter.With regard to the complainant's accusations that MRO told him that he spelled his name, email, and address wrong, that we were not providing him with all of his requested records to "save him money", and that we would not help him "what-so-ever on moving forward" - I listened to the recordings of the phone calls that the complainant had with MRO's customer service representatives and could not find any evidence to support those claims. The recordings of the complainant's phone calls with MRO's customer service representatives demonstrate that the complainant was provided with helpful and courteous customer service and with clear instructions on how to resolve the deficiencies with his request. I would be happy to provide you with recordings of these phone calls if they would be helpful in resolving this matter.After receiving notice of the complaint, left two voicemail messages for the complainant and have sent him an email and letter via U.S. mail asking him to call me so that I can learn more about his experience and try to remedy the inconvenience that he may have been caused. The complainant has not responded to my email and letter.In addition, I saw that the complainant had recently submitted another request for copies of his medical records in our system, so I arranged for those records to be provided to him for no charge.The complainant did return my phone call earlier this week, but I was out of the office attending a conference in Washington, D.C. Instead of leaving a voicemail message for me, however, the complainant went on a highly inappropriate, abusive, expletive-laced rant with one of MRO's customer service representatives who was simply trying to tell him that I was out of the office and that he should leave me a voicemail message. In addition to faxing the Revdex.com this letter, I will also be mailing this letter with a CD-ROM that contains a recording of that phone call. As you will hear, the complainant asked MRO's customer service representative whether she was "dumb or **ing stupid." While I can sympathize with the complainant's frustration, the use of such language is highly offensive and indecent.I left another voicemail message for the complainant this morning and hope to speak to him soon. When I do speak to the complainant, I plan on apologizing for the inconvenience that he may have been caused, telling him how seriously we take his complaint, informing him that we mailed him the copies of records that he requested recently for no charge, and will provide him with my contact information so that if he experiences any issues in the future requesting copies of his records, he can reach out to me directly.Please let me know if I can answer any additional questions or provide you with further information.Sincerely,Sara G.Esq. General Counsel