The HHS’ Office for Civil Rights (OCR) has agreed to settle three HIPAA investigations of potential HIPAA Right of Access violations by dental practices. All three of the investigations were initiated after complaints from patients about the failure of their dental practices to provide them with timely access to their medical records, with one of the cases also involving an allegation of overcharging for a copy of medical records.
A patient of the Georgia-based dental and orthodontics provider, Great Expressions Dental Center of Georgia, P.C. (GEDC-GA), filed a complaint with OCR in November 2020 after being told that she could not be provided with a copy of her medical records unless she paid a $170 copying fee. The HIPAA Right of Access does permit healthcare organizations to charge patients for providing a copy of their medical records, but the costs must be reasonable and cost-based.
OCR’s investigation confirmed that the patient was not provided with a copy of her records until February 2021, 15 months after the initial request. OCR also determined that GEDC-GA’s practice of assessing copying fees resulted in the patient being charged a fee that was not reasonable and cost-based. GEDC-GA chose to settle the case and paid an $80,000 penalty and implemented a robust corrective action plan to address noncompliance with the HIPAA Right of Access.
An investigation was launched into the Chicago, IL-based dental practice, Family Dental Care, P.C. following an August 8, 2020, complaint from a former patient who alleged she had not been provided with a complete set of her medical records. The former patient submitted a request for her complete records in May 2020, but only portions of those records were provided. The patient was not provided with her full records until October 2020, more than 5 months after the initial request was submitted. OCR determined there had been a failure to provide timely access to the requested medical records, which violated the HIPAA Right of Access. Family Dental Care chose to settle the case and paid a $30,000 financial penalty and implemented a corrective action plan to address the non-compliance.
On October 26, 2020, OCR received a complaint from a patient of B. Steven L. Hardy, D.D.S., LTD (doing business as Paradise Family Dental in Las Vegas, NV). The patient alleged to have requested a copy of her and her minor child’s medical records on multiple occasions, but the records had not been provided. The requests were made between April 11, 2020, and December 4, 2020, but the records were not provided until December 31, 2020, 8 months after the initial request was submitted. OCR determined the delay in providing the records violated the HIPAA Right of Access. Paradise chose to settle the case and paid a $25,000 financial penalty and implemented a corrective action plan to address the non-compliance.
“These right of access three actions send an important message to dental practices of all sizes that are covered by the HIPAA Rules to ensure they are following the law,” said OCR Director Melanie Fontes Rainer. “Patients have a fundamental right under HIPAA to receive their requested medical records, in most cases, within 30 days. I hope that these actions send the message of compliance so that patients do not have to file a complaint with OCR to have their medical records requests fulfilled.”
The post 3 Dental Practices Fined for HIPAA Right of Access Violations appeared first on HIPAA Journal.