The Department of Health and Human Services’ Office of Civil Rights has entered into investigative resolutions into three separate dental practices regarding possible breaches of the Health Insurance Portability and Accountability Act confidentiality rules.
These regulatory measures “send an important message to dental practices of all sizes covered by HIPAA rules to ensure they are following the law,” OCR Director Melanie Fontes Rainer said in a statement.
“Patients have a fundamental right under HIPAA to receive their requested medical records, in most cases, within 30 days,” she added. The hope is that the resolutions “send the message of compliance so patients don’t have to file a complaint with OCR to have their medical records requests met.”
Under HIPAA, Covered Entities and Relevant Business Associates are required to respond to patient access requests in a timely manner and in the requested format. Citizen data has shown this to be a huge compliance issue for many providers, although education and awareness has helped improve the current state.
The OCR has made patient access rules an enforcement priority over the past four years and has resolved more than two dozen potential violations.
Great Expressions Dental Center of Georgia (GEDC-GA) agreed to pay a civil penalty of $80,000; Chicago-based Family Dental Care will pay $30,000; and B. Steven L. Hardy, DDS will pay $25,000. All three also agreed to put in place a corrective action plan.
For GEDC-GA, the settlement stems from a November 2020 patient complaint filed with the OCR who alleged that the dental office did not provide her with access to her medical records filed nearly a year earlier in November 2019. GEDC-GA also asked the patient to pay $170. as a “copy fee” before the provider releases the requested records to the patient.
The patient was only contacted by GEDC-GA to send the files on February 2, 2021, a year and a half after the initial request.
The OCR launched an investigation which found that the GEDC-GA had failed to provide the patient with timely access to requested health information in a designated set of records. And the “copy fees” were deemed “unreasonable and cost-based as required by HIPAA.”
The family dental center’s settlement was triggered by an OCR investigation into an August 8, 2020 complaint alleging that the dental provider failed to provide a former patient with timely access to her designated complete record as she l asked on May 8, 2020.
The records were not released to the patient until six months later, on October 12, 2020. OCR found that the family dental center had indeed not provided prompt access, as required by HIPAA.
Finally, the Hardy settlement stems from a patient complaint filed with the OCR on April 11, 2020, alleging that the practice failed to provide a mother with timely access to her protected health information and to those of his minor child.
The HHS investigation found that three days after the access request was emailed to the provider, the patient received an email response stating that “the office was closed and offered to email her -mail the requested PHI if it confirmed the email address to which it should send the PHI.
The patient did so a few weeks later, but after several subsequent requests, the provider then said that the patient should send in a written request with her handwritten signature before providing the requested records. The patient did so on December 4, 2020, and access was provided on December 31 of the same year.
OCR found that Hardy’s practice did not provide quick access.
Settlements do not constitute an admission or liability of guilt. But each supplier will enter corrective action plans with similar requirements. The family dental center agreement will last for one year, and Hardy and GEDC-GA will have two-year action plans. All CAPs revolve around the required development of effective policies and procedures to ensure timely access to patient records.
#HIPAA #patients #access #records #settlements #HHS #warn