Nation’s HIPAA Enforcement Agency Also Has a New Leader
The federal government slapped three dental practices with fines and corrective action plans in its latest round of health privacy law enforcement actions involving patient right of access.
See Also: C-Suite Round-up: Connecting the Dots Between OT and Identity
Settlements with the Department of Health and Human Service’s Office for Civil Rights range from $25,000 to $80,000 and include dental practices in Illinois, Georgia and Nevada.
The department in a Tuesday statement called the settlements part of an ongoing initiative to drive compliance with a HIPAA provision guaranteeing individuals the right to timely and affordable access to their medical records.
Since launching its right of access initiative in April 2019, the civil rights office has brought 41 such enforcement cases.
“I hope that these actions send the message of compliance so that patients do not have to file a complaint with OCR to have their medical records requests fulfilled,” said newly sworn-in OCR Director Melanie Fontes Rainer.
So far this year, OCR has brought 15 HIPAA enforcement actions involving right of access disputes, including today’s (see: Latest HHS HIPAA Actions Spotlight ‘Right of Access’ – Again).
Fontes Rainer was most recently counselor to HHS Secretary Xavier Becerra and focused on civil rights, patient privacy, reproductive health, the Affordable Care Act, competition in healthcare, consumer protection and private insurance markets. She succeeds Lisa Pino, who recently left the position after less than a year in the job.
Dental Practice Settlements
The three dental practices that have agreed to the latest HHS OCR settlements involving right of access cases are:
- Great Expressions Dental Center of Georgia, P.C., a dental and orthodontics provider with multiple locations in Georgia. It agreed to pay an $80,000 financial settlement and implement a corrective action plan after becoming the subject of a November 2020 complaint. A former patient said the practice refused to provider her medical records after she declined to pay a $170 “copying” fee. The federal investigation determined the practice’s copying fees were not reasonable.
- Chicago-based Family Dental Care, P.C., agreed to pay $30,000 and implement a corrective plan to resolve a case involving a complaint OCR received in August 2020. A former patient requested her entire records in May 2020 but received only portions. During OCR’s investigation into the complaint, the practice provided the former patient with all her records.
- Las Vegas, Nevada-based B. Steven L. Hardy, D.D.S. Ltd., which does business as Paradise Family Dental, agreed to pay a $25,000 settlement and implement corrections in a case involving a complaint in October 2020. The complaint alleged that Paradise failed to provide a mother with copies of her and her child’s health records after multiple requests made between April and December 2020. Paradise did not provide the requested record until December 2020, more than eight months after the initial request.
Mike DeMinico, Great Expressions Dental Centers’ general counsel, said in a statement to Information Security Media Group that the practice has made it easier for patients to receive their dental records. That includes eliminating cost-based fees associated with their copying and provision.
“All patients will receive their records without charge when requested,” he said. Also, the practice has instituted “newer and better HIPAA training, ensuring that each of our team members is fully aware of their responsibilities to our patients.”
Family Dental Care and Paradise Family Dental did not immediately respond to Information Security Media Group’s requests for comment.
Looking Ahead
Right of access cases appear to remain a mainstay enforcement priority for HHS OCR. Aside from HHS OCR’s 15 right of access enforcement cases so far this year, the agency has only taken enforcement actions in two other cases that involved different alleged HIPAA violations.
Privacy attorney Adam Greene of the law firm Davis Wright Tremaine predicts more rounds of HIPAA enforcement actions by the agency in the months to come but perhaps less activity involving other HIPAA regulatory matters.
“We often get a bit of a lull in enforcement when new directors come on, so I expect that enforcement will increase slightly after Director Fontes Rainer has been in her position a bit longer,” says Greene, a former senior adviser at HHS OCR.