On September 20, 2022, the Office for Civil Rights (“OCR”) at the U.S. Department of Health and Human Services announced its resolution of three separate investigations against covered entity dental providers for violations of the individual’s right of access under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). This announcement follows the announcement of 11 right of access investigation resolutions released on July 15, 2022 (referenced here), bringing the total number of enforcement actions under OCR’s Right of Access Initiative to 41.
Similar to prior resolutions, each of these settlements relates to potential noncompliance with respect to only one patient. We note that the key takeaways continue to involve basic right of access issues, such as timeliness of the response, whether or not the records produced are complete, failure to charge fees that are reasonable and cost-based and failure to provide requested access to a legal guardian acting as the personal representative of a minor child.
Per-violation penalties for a right of access violation vary based on the level of culpability. Culpability levels include: (i) a violation where the covered entity or business associate did not and would not reasonably know; (ii) reasonable cause without willful neglect; (iii) willful neglect where the violation is corrected within 30 days; and (iv) willful neglect if the violation is not corrected within 30 days. While penalties for violations typically range from $127 to $63,973, penalties for violations due to willful neglect that are not timely corrected can be as high as $1,919,173 per violation. The maximum calendar‑year penalty cap for all violations of an identical HIPAA provision is currently $1,919,173.
Summary of Enforcement Actions Announced in September
| Type of Covered Entity | Location | Financial Impact | Summary |
| Dental Provider | Illinois | $30,000 | A dental provider failed to provide a patient with timely access to requested medical records. When requested, the provider only released a portion of the requested records. It was not until five months later that the patient received all requested records. The provider paid $30,000 and entered into a one-year corrective action plan as part of a resolution agreement. |
| Dental and
Orthodontic Provider |
Georgia | $80,000 | A dental and orthodontic provider refused to provide requested records to the patient because the patient refused to pay a $170 copying fee. Ultimately, the patient did not receive the requested records until one year after the initial request. OCR found the provider failed to provide timely access to records and that the imposed copying fees were not reasonable and cost-based. The provider paid $80,000 and entered into a one-year corrective action plan as part of a resolution agreement. |
| Dental Provider | Nevada | $50,000 | A dental provider failed to provide a legal guardian the records of her minor child after multiple requests within an eight-month period. The provider paid $50,000 and entered into a two-year corrective action plan as part of a resolution agreement. |
More Information
Please view our comprehensive article on OCR’s Right of Access Initiative here, which includes a summary of the HIPAA compliance requirements and a deeper dive into lessons learned from the enforcement activity to date.
Questions
If you have any questions or would like additional information about this topic, please contact:
- Stephane Fabus at (414) 721-0904 or sfabus@hallrender.com;
- Krystal Villarruel at (317) 429-3639 or kvillarruel@hallrender.com; or
- Your primary Hall Render contact.
Hall Render blog posts and articles are intended for informational purposes only. For ethical reasons, Hall Render attorneys cannot give legal advice outside of an attorney-client relationship.
