Gums Dental Care, a solo dental practice in Silver Springs, Maryland, attempted to charge a patient $25 for her medical records. The patient asked for the records, didn’t receive them, and followed up with a second request, ultimately filing a complaint with the Office for Civil Rights (OCR), which oversees HIPAA. The dental practice paid $70,000 to settle the case after OCR investigated.
Right of Access Initiative
Under HIPAA’s right of access rules, healthcare providers must promptly grant patients access to their medical records and may not impose unreasonable fees for this access.
OCR initially received a complaint alleging that Gums Dental Care (GDC) had not provided the patient access to her and her children’s medical records. The patient asked for the records twice, in April 2019 and June 2019. OCR sent a technical assistance letter to GDC outlining its obligation to respond to medical record requests and subsequently closed the complaint.
Right of Access Investigation and Final Decision
OCR initiated an investigation after the patient filed a second complaint, stating that she still had not received access to her records. The investigation revealed that GDC failed to respond promptly to the patient’s request for access. Although the patient requested the records twice in 2019, GDC did not attempt to provide them until May 2022, three years later.
In March 2022, OCR issued a Notice of Proposed Determination, recommending a civil monetary penalty of $70,000. Gums Dental Care contested this Notice and requested a hearing with an Administrative Law Judge (ALJ). On September 29, 2023, the ALJ upheld the $70,000 penalty. Gums Dental Care then appealed the decision, and on March 22, 2024, the Departmental Appeals Board affirmed the ALJ’s ruling. As a result, OCR issued a Notice of Final Determination on October 17, 2024, imposing the $70,000 civil monetary penalty.
HIPAA Enforcement of the Right of Access is Consistent
OCR has vigorously enforced the right of access rules since September 2019, when it began the right of access initiative. This latest settlement by Gums Dental Care is the fiftieth settlement in the five years since the right of access initiative began.
Three years ago, OCR settled investigations with three dentists. Those settlement amounts ranged from $25,000 to $80,000.
In 2024, three right of access settlements were announced before the Gums Dental Care case. There were two right of access settlements with long-term care facilities, and an EMS provider settled a HIPAA right of access investigation in August 2024
Right of Access Rules are Easy to Follow
The owner of Gums Dental Care demanded $25 from the patient but ended up paying $70,000 (and legal fees) to defend this stance. HIPAA is clear about the right of access, and the rule is easy to follow. Review the rule and make sure staff understand its importance.
- The patient may choose the form and format of the records – paper or electronic, and delivered by mail or email.
- Produce the records promptly, but take no longer than 30 days unless there is a good reason for more time. If so, notify the patient that another 30 days will be needed. NOTE: If state law is stricter than HIPAA, follow the State. California, for example, requires copies to be provided within 15 days or access to view them during business hours within five days
- Fees, if any, should be minimal.
- Don’t confuse the right of access (for the individual) with the required HIPAA authorization (for a third party who is NOT a personal representative).
