HIPAA Certify

HHS Imposes $70,000 Penalty for Right of Access Violation

Gums Dental Care, LLC

The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has announced a $70,000 civil monetary penalty against Gums Dental Care, LLC, a solo dental practice in Maryland. This penalty marks OCR’s 50th right of access enforcement action, emphasizing the critical importance of timely patient access to medical records under HIPAA regulations.

Key Points:

  1. Violation: Gums Dental Care failed to provide a patient with timely access to their and their children’s medical records, despite multiple requests.
  2. HIPAA Requirement: The HIPAA Privacy Rule mandates that individuals have access to their health information within 30 days (with a possible 30-day extension) at a reasonable, cost-based fee.
  3. Investigation Timeline:
 
    • April & June 2019: Patient submitted written requests for records
    • May 2022: Gums Dental Care attempted to provide records
    • March 2022: OCR issued a Notice of Proposed Determination
    • September 29, 2023: Administrative Law Judge imposed the $70,000 penalty
    • March 22, 2024: Departmental Appeals Board affirmed the decision
 
  1. OCR Director’s Statement: Melanie Fontes Rainer emphasized that patients should not have to make multiple requests or file complaints to access their own medical records.
  2. Implications: This case underscores the importance of prompt compliance with patient requests for medical records and the potential consequences of non-compliance.

Reminder for Healthcare Providers:

  • Ensure systems are in place to respond promptly to patient requests for medical records.
  • Familiarize staff with HIPAA right of access requirements.
  • Implement processes to track and fulfill record requests within the mandated timeframe.

For more information on HIPAA compliance and right of access guidelines, visit the HHS OCR website or consult with HIPAA Certify professionals.