Three dental providers settle cases for potential HIPAA violations regarding records

'Patients have a fundamental right under HIPAA to receive their requested medical records'

The U.S. Department of Health and Human Services Office for Civil Rights announced the resolution of three investigations into different dental providers in regards to record requests on Sept. 20 concerning potential violations of the Health Insurance Portability and Accountability Act Privacy Rule.

The trio of dental providers faced investigations on allegedly not providing requested records to patients in a timely manner.

“These three right of access actions send an important message to dental practices of all sizes that are covered by the HIPAA Rules to ensure they are following the law,” said Office for Civil Rights Director Melanie Fontes Rainer in a news release . “Patients have a fundamental right under HIPAA to receive their requested medical records, in most cases, within 30 days. I hope that these actions send the message of compliance so that patients do not have to file a complaint with [the Office for Civil Rights] to have their medical records requests fulfilled.”

“It’s important that my dental colleagues are aware of and follow the regulations set forth by the Health Insurance Portability and Accountability Act, when applicable,” said James Hoddick, ADA Council on Dental Practice chair. “The HIPAA Privacy Rule provides patients with a legal, enforceable right to see and receive copies upon request of their health records maintained by their dental provider. Compliance helps ensure the success of the dental office in being transparent, which in turn helps lead to optimal care and a more fruitful dentist-patient relationship.”

According to the release, the Office for Civil Rights took the following enforcement actions:

• The Office for Civil Rights received a complaint on Aug. 8, 2020, alleging that that a dental practice in Illinois failed to provide a former patient with timely access to her complete patient records. The former patient requested her entire dental records in May 2020 but received only portions. The former patient filed a complaint with the Office for Civil Rights, and an investigation determined that the practice’s failure to provide timely access to the requested medical records was a potential violation of the HIPAA right of access provision. The practice agreed to pay $30,000 and implement a corrective action plan.
• In November 2020, the Office for Civil Rights received a complaint alleging that a dental practice in the state of Georgia would not provide an individual with copies of her records because she would not pay a $170 copying fee. The individual first requested her records in November 2019 but did not receive them until February 2021. The Office for Civil Rights investigation determined that the provider’s failure to provide timely access to the requested medical records and its practice of assessing copying fees that were not reasonable and cost-based were potential violations of the HIPAA right of access provision. The practice agreed to pay $80,000 and implement a corrective action plan.
• On Oct. 26, 2020, the Office for Civil Rights received a complaint alleging that a dental practice in Nevada had failed to provide a mother with copies of her and her minor child’s protected health information. The mother submitted multiple record requests, but the practice did not send the records until more than eight months after her initial request. An investigation determined that the practice’s failure to provide timely access to the requested records was a potential violation of the HIPAA right of access provision. The practice agreed to pay $25,000 and implement a corrective action plan.

The Office for Civil Rights provides guidance on the right of access provision.