Three dental practices across the country became the latest medical professionals to learn that the HHS Office for Civil Rights (OCR) is serious about patients’ right of access under HIPAA. OCR announced three settlements that total $135,000 in civil monetary penalties for dentist HIPAA violations.
Background of Dentist HIPAA Violations
Acting in their role as the enforcement arm for HIPAA violations, OCR has been placing extra emphasis on right of access violations for more than two years. These three cases bring the number of announced settlements and fines for these types of HIPAA violations to 41.
The HIPAA Privacy Rule guarantees patients right of access to their medical records. In most cases, patient requests for their medical records should be honored within 30 days.
In a statement on the HHS website, newly-appointed OCR Director Melanie Fontes Rainer made clear that her office was sending a message.
“These three right of access actions send an important message to dental practices of all sizes that are covered by the HIPAA Rules to ensure they are following the law,” said Fontes Rainer.Â
“Patients have a fundamental right under HIPAA to receive their requested medical records, in most cases, within 30 days. I hope that these actions send the message of compliance so that patients do not have to file a complaint with OCR to have their medical records requests fulfilled.”
Chicago, Illinois Dentist HIPAA Violations
A former patient of Family Dental Care P.C. (FDC) filed a complaint with OCR on August 8, 2020, alleging that she had not received timely access to her complete medical records. She initially requested her records in May 2020 but only received some of her records. Following her complaint, After OCR began its investigation, FDC provided the remainder of her records in October 2020, five months after her first request. OCR’s findings identified a potential violation of HIPAA’s right of access provision. FDC agreed to pay $30,000 and implement a corrective action plan.
Georgia Dentist HIPAA Violations
Great Expressions Dental Center of Georgia P.C. (GEDC) provides dental and orthodontic services at multiple locations throughout Georgia. A patient first requested her records in November 2019 but was told she would have to pay a $170 copying fee.Â
The patient filed a complaint with OCR in November 2020 and received her records in February 2021. OCR’s investigation found potential violations for failure to provide records in a timely manner and assessing copying fees that were not reasonable and cost-based. As a result, GEDC paid $80,000 in penalties and agreed to implement a corrective action plan.
Las Vegas, Nevada Dentist HIPAA Violations
B. Steven L. Hardy, D.D.S., LTD, doing business as Paradise Family Dental, failed to provide a mother and her minor child with copies of their protected health information (PHI) for more than eight months after an initial request in April 2020. After filing multiple requests for the information, she notified OCR on October 26, 2020, and finally obtained the records in December 2020. OCR’s investigation determined that there was a probable violation of HIPAA’s right of access provision and the practice agreed to pay $25,000 and implement a corrective action plan.
