Today, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced a $70,000 civil monetary penalty against Gums Dental Care, LLC, a solo dental practice in Maryland that provides family dental care. This penalty resulted from an investigation based on a complaint that Gums Dental Care failed to provide a patient with timely access to their medical records. According to the HIPAA Privacy Rule’s right of access provisions, individuals or their personal representatives must have timely access to their health information (within 30 days, with a possible one-time 30-day extension) for a reasonable, cost-based fee.
“OCR Director Melanie Fontes Rainer stated, “An essential hallmark of HIPAA is the right to patients’ timely access to their medical records. Patients should not have to make multiple requests and file complaints with HHS’ Office for Civil Rights to get their own medical records. This investigation marks OCR’s 50th right of access enforcement action. Health care providers should get the message—loud and clear—when a patient seeks their medical information, you must provide it to them, period.”
OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules, which set forth the requirements that covered entities (health plans, health care clearinghouses, and most health care providers) and business associates must follow regarding the privacy and security of protected health information. The HIPAA Privacy Rule establishes national standards to protect individuals’ medical records, sets limits and conditions on the uses and disclosures of protected health information, and gives individuals certain rights, including the right to timely access and to obtain a copy of their health records. This is a critical part of HIPAA and patient empowerment with their data.
OCR first received a complaint alleging that Gums Dental Care had failed to provide the complainant access to her and her children’s medical records. OCR sent a technical assistance letter notifying Gums Dental Care of its obligation to respond to requests for medical records and closed the complaint. After the complainant filed a second complaint alleging Gums Dental Care had still not provided access to the requested records, OCR opened an investigation. The investigation found that Gums Dental Care failed to take timely action in response to the patient’s right of access request. Specifically, the complainant submitted written requests for the records in April 2019 and again in June 2019, but Gums Dental Care did not attempt to provide the records until May 2022. In March 2022, OCR issued a Notice of Proposed Determination seeking to impose a $70,000 civil monetary penalty. Gums Dental Care challenged the Notice of Proposed Determination and requested a hearing before an Administrative Law Judge (ALJ). On September 29, 2023, the ALJ imposed the $70,000 civil monetary penalty. Gums Dental Care appealed the decision, and on March 22, 2024, the Departmental Appeals Board affirmed the decision. Accordingly, OCR imposed the $70,000 civil monetary penalty in a Notice of Final Determination.