By Lee Slaton, Vice President of Healthcare; Smart TrainingComplaints from patients that their dental practices failed to provide timely access to their medical records—one with an added allegation of overcharging for a copy of records—resulted in investigations by the U.S. Department of Health and Human Services Office for Civil Rights (OCR) of potential HIPAA Right of Access (ROA) violations at three practices.
Case 1
A patient of Great Expressions Dental Center in Georgia, P.C., filed a complaint in November 2020 after being told she would have to pay a $170 copying fee to receive a copy of her records. Dental practices may charge patients for providing a copy of their medical records, but the fee must be reasonable and cost-based, according to the HIPAA Right of Access. The patient was also not provided a copy of her records until February 2021—15 months after the initial request.
Outcome: OCR determined that Great Expressions’ practice of assessing copying fees resulted in the patient being charged a fee that was neither reasonable nor cost-based. The practice chose to settle the case and paid an $80,000 penalty and implemented a robust corrective action plan to address noncompliance with HIPAA Right of Access.
Case 2
Chicago-based Family Dental Care was investigated following an August 8, 2020 complaint. A former patient alleged she’d not been provided with a complete set of her medical records. A request for her complete records was submitted in May 2020, but only portions were provided. In addition, more than five months passed before the patient was provided her full records.
Outcome: OCR determined there had been a failure to provide timely access to the requested medical records, which violated the HIPAA Right of Access. The practice chose to settle the case and paid a $30,000 penalty and implemented a corrective action plan to address the non-compliance.
Case 3
A patient alleged she’d requested a copy of her and her minor child’s medical records on multiple occasions from Paradise Family Dental in Las Vegas, but the records had not been provided. The requests were made between April 11–December 4, 2020; but the records were not provided until December 31, 2020—8 months after the initial request was submitted.
Outcome: OCR determined the delay in providing the records violated the HIPAA Right of Access. Paradise chose to settle the case and paid a $25,000 penalty and implemented a corrective action plan to address the non-compliance.
Patients have a fundamental right under HIPAA to receive their records—usually within 30 days. Unfortunately, far too many practices don’t treat these patient requests with the urgency they require; and these three examples are only the tip of the ROA iceberg.
Nov. 18, 2022, webinar details how to avoid these massive penalties
If you’re not sure of your practice’s HIPAA Right of Access procedures or whether your practice is carrying them out in a timely manner, join Smart Training’s Certified HIPAA Professional Jim Moore for a short and informative webinar on Friday, Nov. 18, as he goes through what you need to have in place and reviews upcoming changes to HIPAA regulations. There will be ample time devoted to answering practitioners’ questions. Don’t miss this engaging discussion of a very important topic. Register for webinar.