Dental Practices Pay Price for HIPAA Right of Access Noncompliance
The HIPAA Right of Access provides individuals with the right to obtain a copy of the medical records held by their healthcare providers. The records must be provided within 30 days of the request being submitted, although a further 30 days is permitted in certain circumstances. Fees can be charged for providing copies of medical records, but those fees must be reasonable and cost-based.
In late 2019, the Department of Health and Human Services’ Office for Civil Rights (OCR) launched a new HIPAA enforcement initiative targeting noncompliance with the HIPAA Right of Access. Investigations are conducted promptly when complaints are filed by patients who claim to have not been provided with timely access to their medical records, have been denied access to their records, or when they are charged an unreasonable fee for obtaining a copy of their records.
OCR has recently announced a further three HIPAA Right of Access cases have been settled, all of which resolve alleged violations of the HIPAA Right of Access by dental practices. These three cases bring the total number of cases under the HIPAA Right of Access enforcement initiative that have resulted in financial penalties up to 41.
Great Expressions Dental Center of Georgia, P.C.
Great Expressions Dental Center of Georgia, P.C. has dental practices throughout the state of Georgia. An investigation was launched by OCR in response to a November 2020 complaint from a patient who was not provided with her records because she refused to pay a $170 copying fee. The patient submitted her first request in November 2019 but was not provided with the records until February 2021. OCR determined the fees were excessive and the practice failed to provide timely access. The case was settled for $80,000 and a corrective action plan was implemented.
Family Dental Care, P.C.
Family Dental Care, P.C., is a dental practice in Chicago, IL. An investigation was launched by OCR in response to an August 8, 2020complaint from a patient who alleged she had not been provided with her complete medical records and only received portions of those records. The request for the records was first made in May 2020 but it took more than five months for all her records to be provided. The full set was received in October 2020. OCR determined the practice had failed to provide the patient with timely access to her medical records. The case was settled with OCR for $30,000 and a corrective action plan was adopted.
B. Steven L. Hardy, D.D.S., LTD, (Paradise Family Dental)
Steven L. Hardy, D.D.S., LTD, operates a dental practice in Las Vegas, NV called Paradise Family Dental. OCR launched an investigation after receiving an October 2020 complaint from a patient alleging Paradise had not provided copies of the medical records of a mother and her minor child, despite multiple requests being made between April 11, 2020, and December 4, 2020. The records were not provided until December 31, 2020, more than eight months after the initial request. OCR determined the practice had failed to provide the patient with timely access to her and her minor child’s medical records. The case was settled with OCR for $25,000 and a corrective action plan was adopted.
