The U.S. Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) has issued a Notice of Final Determination finding that Cignet Health of Prince George’s County, Md., (Cignet) violated the Privacy Rule of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). HHS has imposed a civil money penalty (CMP) of $4.3 million for the violations, representing the first CMP issued by the Department for a covered entity’s violations of the HIPAA Privacy Rule.
[…]
In a Notice of Proposed Determination issued Oct. 20, 2010, OCR found that Cignet violated 41 patients’ rights by denying them access to their medical records when requested between September 2008 and October 2009. These patients individually filed complaints with OCR, initiating investigations of each complaint. The HIPAA Privacy Rule requires that a covered entity provide a patient with a copy of their medical records within 30 (and no later than 60) days of the patient’s request. The CMP for these violations is $1.3 million.
During the investigations, Cignet refused to respond to OCR’s demands to produce the records. Additionally, Cignet failed to cooperate with OCR’s investigations of the complaints and produce the records in response to OCR’s subpoena. OCR filed a petition to enforce its subpoena in United States District Court and obtained a default judgment against Cignet on March 30, 2010. On April 7, 2010, Cignet produced the medical records to OCR, but otherwise made no efforts to resolve the complaints through informal means.
Read more in the Sun Herald. So far, I don’t see a copy of the press release or documentation on HHS’s web site, but I’ll keep checking.
Update: Thanks to Joseph Lazzarotti, here are the links to the Notice of Final Determination and the Notice of Proposed Determination
Also, HHS has posted a release to its site, here, with the links to the determinations.
Like many bloggers/observers, I find myself wondering what the heck Cignet was thinking in not complying with an OCR investigation. Not providing patients with their records is a serious issue, but most of this fine was intended as an “attitude adjustment” reminder that yes, not only do entities have to comply with HIPAA, but they have to comply with investigations.