In 2019, the U.S. Department of Health and Human Services’ Office of Civil Rights (OCR) announced its HIPAA Right of Access Initiative. Under the Initiative, OCR investigates violations of the HIPAA Privacy Rules, particularly related to the ability of patients to access their PHI. The HIPAA Privacy Rule generally requires covered entities to provide individuals access to their “designated record sets” maintained by or for the covered entity. The access requirements generally do not apply to (1) information not considered “designated record sets,” as defined by 45 C.F.R. § 164.501, (2) psychotherapy notes, and (3) records created in reasonable anticipation of or for a civil, criminal, or administrative action. 45 C.F.R. § 164.524.
Since 2019, there have been at least two dozen announced settlements related to OCR’s Right of Access Initiative, and these settlements have largely involved medical providers and organizations. Dental practices have gone unscathed. However, OCR’s recent announcements clarify that dental practices are not exempt from the HIPAA rules and alleged violations by dental practices will not be overlooked.
On March 28, 2022, OCR announced one of its first settlements involving a dental practice that allegedly violated HIPAA rules by purportedly failing to provide a patient with a copy of their medical record. Before settling, OCR imposed a $104,000 civil monetary penalty against Donald Brockley, D.D.M., a solo dental practitioner. However, Dr. Brockley and OCR agreed to settle for $30,000. As part of the settlement, Dr. Brockley will also take corrective actions to comply with the HIPAA Privacy Rule.
Providers and medical practice administrators, including dentists and dental practices, should familiarize themselves with patients’ rights under HIPAA to access protected health information by reviewing the related statutes (45 C.F.R. § 165.524) and HHS guidance. Enforcement actions will continue. Dental practices should also take note that, besides Dr. Brockley’s settlement, OCR also announced settlements with dental practices involving improper disclosure of PHI in violation of HIPAA rules. Dentists and dental practices are not exempt from HIPAA rules and OCR’s enforcement efforts.
The attorneys at Chilivis Grubman assist businesses of all types and sizes in connection with HIPAA-related matters, including breach response, breach notification, OCR investigations, and resulting civil litigation. If you need assistance with such a matter, please contact us today.