The Office of Civil Rights (OCR) of the U.S. Department of Health and Human Services (“HHS”) has announced three more settlements with dental practices as part of its enforcement initiative of the individual access provision of HIPAA. Under this provision of the privacy rule, individuals have the right to access their protected health information (PHI), in most cases, within 30 days. These settlements bring the total number of settlements that OCR has reached under this initiative to forty-one.
OCR’s latest three settlements involve dental practices: Family Dental Care, P.C., in Chicago, IL, Great Expressions Dental Center of Georgia, P.C., and B. Steven L. Hardy, D.D.S., LTD, d/b/a Paradise Family Dental in Las Vegas, NV. Although these practices are HIPAA-covered entities, they failed to allow patients timely access to their complete medical records as required by the individual access provision of HIPAA. Under the terms of each settlement, each practice agreed to pay between $30,000 and $80,000 and submit to a corrective action plan (CAP) approved by OCR. Under the terms of each CAP, the dental practices must:
- Revise their policies and procedures related to individuals’ rights to access their PHI;
- Incorporate their revised policies and procedures into HIPAA training materials; and
- Provide annual HIPAA training to workers.
