The HHS’ Office for Civil Rights (OCR) has made a decision to settle three investigations of dental practices for probable violations of HIPAA Right of Access . The three investigations were started after patients filed complaints about the failure of their dental practices to give them prompt access to their medical records, as one of the investigations involved an allegation of charging too much for a copy of patient records.
A patient of Great Expressions Dental Center of Georgia, P.C. (GEDC-GA) filed a complaint with OCR in November 2020 after the dental and orthodontics provider told her that a copy of her health records will only be given after paying a $170 copying cost. The HIPAA Right of Access allows healthcare companies to impose patients for offering a copy of their medical records, however, the costs should be affordable and cost-based.
OCR’s investigation stated that the patient did not get a copy of her medical records until February 2021, which is 15 months after the preliminary request. OCR additionally learned that GEDC-GA’s practice of evaluating copying charges resulted in the patient being invoiced a payment that was not sensible and cost-based. GEDC-GA decided to negotiate the case and paid an $80,000 penalty and executed an effective corrective action plan to deal with noncompliance with the HIPAA Right of Access.
An investigation of Family Dental Care, P.C. based in Chicago-IL began following a former patient who submitted a complaint on August 8, 2020 alleging that the dental practice didn’t provide her with a complete set of her medical records. The former patient filed a request for her complete files in May 2020, however, only sections of that information were made available. The patient only received her full records on October 2020, over 5 months after the first request was sent. OCR reported there was a failure to offer on-time access to the asked-for healthcare records, which violated the HIPAA Right of Access. Family Dental Care opted to resolve the case by spending $30,000 financial penalty and executed a corrective action plan to handle the non-compliance.
OCR received a complaint on October 26, 2020 coming from patient B. Steven L. Hardy, D.D.S., LTD (doing business as Paradise Family Dental located in Las Vegas, NV). The patient stated to have filed a request for a copy of her and her minor child’s medical files on several occasions, nevertheless, the records were not made available. The requests were filed between April 11, 2020, and December 4, 2020, yet the files were not provided until December 31, 2020, 8 months following the first filing of the request. OCR decided the delay in giving the records broke the HIPAA Right of Access. Paradise opted to take care of the case and paid a $25,000 financial fine and enforced a corrective action plan to tackle the violation.
OCR Director Melanie Fontes Rainer stated that the enforcement action involving the three right of access violations highlights why dental practices of all sizes need to follow the HIPAA Rules. Patients have a basic right covered by HIPAA to get their requested health records, in many instances, within 30 days. If companies comply, there will be fewer patients to file a complaint with OCR concerning their medical records requests.