OCR Imposes $70,000 Civil Monetary Penalty on Gums Dental Care for HIPAA Right of Access Violation
The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) reported the 9th financial penalty of 2024 involving alleged Health Insurance Portability and Accountability Act (HIPAA) Rules violations. OCR issued a civil monetary penalty of $70,000 to Gums Dental Care based in Silver Spring, MD for not giving a patient access to her and her children’s health records promptly. Since OCR started its HIPAA Right of Access enforcement initiative in 2019, OCR has issued 50 HIPAA Right of Access enforcement actions with a financial penalty including this one.
The complainant submitted a written request for copies of her protected health Information (PHI) and that of her kids to Gums Dental Care on or about April 8, 2019. She asked for the information to be sent to her email and got an answer the same day stating the number of times they had been to the dental practice, yet no record was provided. On May 1, 2019, she submitted a complaint to OCR for not receiving the requested medical records. OCR offered technical support to Gums Dental Care on May 7, 2019, about the HIPAA Right of Access and dismissed the case.
The technical support urged Gums Dental Care to review the technical support material with its employees, evaluate and find out if the complainant’s statement was truthful, and give the requested information to the complainant immediately if it was proper. Gums Dental Care was likewise advised that if OCR got another complaint, the dental practice would formally investigate. On June 26, 2019, the complainant submitted one more request with Gums Dental Care through email and mentioned that she would like the medical records emailed or a paper copy sent to her by mail; nevertheless, she did not receive the medical records. On August 2, 2019, she submitted a second complaint to OCR and requested the records from Gums Dental Care for the third time on August 26, 2019.
OCR alerted Gums Dental Care concerning the second complaint and sent a data request letter on September 5, 2019. However, OCR didn’t get an answer from Gums Dental Care. The response given by OCR was to the offered resolution agreement and corrective action plan. The owner of the dental practice, Dr. Anna Gumbs, replied and said that the requested documents were not given as the complainant did not pay the $25 administration fee before the records could be sent via certified mail. She additionally mentioned that she got the notion that the complainant would use the data for insurance scam by re-filing claims to another insurance company for healthcare services that were already paid for by Maryland Medicaid.
Although HIPAA-covered entities are allowed to impose a fair, cost-based sum for specific labor, resource, and postage expenses, the $25 fee was unacceptable since the complainant had asked for the medical records to be provided through email. OCR additionally stated that although the complainant had voluntarily mentioned she meant to commit insurance fraud or the practice had known about the planned fraud, it is not an acceptable reason under the HIPAA Privacy Rule and could not be the basis to deny a Right of Access request.
Gums Dental Care was told about the decision to issue a civil monetary penalty for a HIPAA Right of Access violation and was granted the chance to submit proof for a waiver of the civil monetary penalty. Dr. Gumbs explained that she was trying to avert insurance fraud and could not transmit information through email because she failed to have a safe website with sufficient safety measures to guarantee the safe delivery of healthcare records.
OCR explained Gums Dental’s statement that they lack a protected website, and cannot give the requested data by email doesn’t free Gums Dental from the obligation to give the Complainant the requested data. Gums Dental has no proof of attempting to provide the data in any form or formatting. Because Gums Dental did not give the records, it is given a $70,000 financial penalty as authorized by the Attorney General of the United States.
Dr. Gumb questioned OCR’s Notice of Proposed Determination and asked for a judge to hear the case; nonetheless, the judge decided in favor of OCR’s determination and enforced the civil monetary penalty. Dr. Gumb’s appeal involving the judge’s decision did not succeed. The Departmental Appeals Board confirmed the decision of the judge as well as the $70,000 penalty.