Disclaimer: This blog article was written by an AdvancedMD partner. The views and opinions expressed in this article are those of the author(s) and do not necessarily reflect the official policy or position of AdvancedMD.
Gums Dental, a solo dental practice and a “covered entity” under HIPAA, was found non-compliant with the Privacy Rule regarding a patient’s right to access medical records. In April 2019, a patient requested electronic copies of her and her children’s health records, which Gums Dental failed to provide. Following several follow-up requests and complaints to the Office for Civil Rights (OCR), Gums Dental did not produce the records, violating HIPAA’s 30-day timeline for access.
The Office for Civil Rights (OCR), the branch of CMS that enforces HIPAA rules, provided technical assistance and issued reminders but Gums Dental continued to deny the requests. Gums Dental cited a flat fee of $25 for mailing the records and suspicions of potential insurance fraud as justification. OCR noted that the Privacy Rule does not permit denial of access based on assumptions of intent or demand for non-applicable fees. Despite further requests and investigation reminders from OCR, Gums Dental did not provide the records or demonstrate any mitigating factors.
OCR determined Gums Dental violated HIPAA by failing to provide patient access to medical records, despite lawful requests and repeated guidance from OCR. The violation, categorized as “willful neglect, uncorrected,” occurred from August 26, 2019 through March 29, 2022.
OCR considered several factors when determining the Civil Monetary Penalty (CMP) for Gums Dental’s HIPAA violation, including:
- Nature and Extent of Harm: The Complainant’s family was denied dental services by Gums Dental, reportedly as retaliation for the complaint filed with OCR, and could not access insurance reimbursement due to lack of records.
- Nature and Extent of Violation: Gums Dental ignored repeated requests to provide the Complainant’s records and failed to act on OCR’s technical assistance and data requests, resulting in an ongoing two-year-plus violation.
- Compliance History: Gums Dental previously disregarded OCR’s guidance and data requests but has no other recorded compliance issues.
- Financial Condition: OCR acknowledged Gums Dental’s status as a solo provider, though it lacked detailed financial information due to Gums Dental’s non-cooperation.
Given the ongoing nature of the violation and the impact on the Complainant’s access to care, OCR assessed a daily penalty of $63,973 for willful neglect. However, considering the financial implications on Gums Dental as a solo practice, OCR exercised discretion to reduce the penalty to $70,000, factoring in potential challenges from the COVID-19 pandemic.
Source Gums Dental Care, LLC Notice of Proposed Determination | HHS.gov
The HIPAA right of access rule is just one of the many rules small practices must be compliant with. TLD Systems can assist your practice in setting up polices and procedures to keep you on track and compliant with the various rules and regulations. For more information on how TLD Systems can assist your practice contact TLD Systems at
https://www.tldsystems.com
phone: (631) 403 6687
email: [email protected]
