Dentists See a Record-Setting Year for HIPAA Enforcement Action

HIPAA enforcement actions have been brought against dentists more than any other covered entity so far this year, requiring dentists to become more aware of their responsibilities under the law. J. Kathleen Marcus weighs in.

By J. Kathleen Marcus, Esq.

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) remains one of the most misunderstood federal health laws. However, as part of increased enforcement of HIPAA by the HHS Office of Civil Rights (OCR), three more dentists have been sanctioned for failure to timely produce medical records upon patient request.

Honoring Patient’s Requests for Records

Under the HIPAA Privacy Rule, covered entities (which includes all healthcare providers) must give patients (or the parents of minor patients) medical records within thirty calendar days of a written request. Patients have a right to all medical records including billing and payment records, insurance information, clinical laboratory test results, medical images, such as X-rays, and clinical case notes. While HIPAA requires that the request by the patient is in writing and that the provider takes “reasonable” steps to verify the identity of the person making the request, healthcare providers may not require that the patient pick up the records at the office, use a web portal to access the records, or mail a release to the provider for the records.

The provider must also produce the records in the form requested – paper if paper is requested, and electronically if electronic records are requested.

Healthcare providers can charge for the production of the records but only the actual cost of paper and labor – no surcharge whatsoever.

Non-compliance Equals Fines

This latest OCR press release announced that a Chicago dental office would pay $30,000 for taking five months to provide the requested records. In addition, a Georgia dental office must pay $80,000 for taking a year to produce records for a former patient and a Nevada dental office will pay $25,000 for taking a year to produce a child’s records to the requesting parent.

Regarding these cases, OCR Director Melanie Fontes Rainer stated, “Patients have a fundamental right under HIPAA to receive their requested medical records, in most cases, within 30 days. I hope these actions send the message of compliance so that patients do not have to file a complaint with OCR to fulfill their medical records requests.”

Record-Setting Enforcement

These cases are the latest in a record-setting year of HIPAA enforcement actions. More HIPAA enforcement actions this year have been brought against dentists than any other covered entity, calling attention to the need for dentists to be aware of their obligations under HIPAA and the hefty fines that can result from failing to comply.

The American Dental Association (ADA) has created a "Tip Sheet on Certain Provisions of the HIPAA Privacy Rules" for further formation. DOCS members can direct HIPAA questions to: [email protected].

Author: J. Kathleen Marcus, Esq., is uniquely qualified to advise and advocate for sedation dentistry, she draws on a healthcare law background that started over three decades ago. A 1988 graduate of Temple University School of Law, she was Research Editor of the Temple Law Review; she previously attended Bennington College and has a B.A. in Philosophy. Pennsylvania licensed, Kate spends her free time practicing sustainability in her suburban Philadelphia garden and on her land in the Guatemalan highlands around Lake Atitlan.

DOCS Membership

Upcoming Events
May 17- 18, 2024
Atlanta, GA skyline
August 23- 24, 2024
October 04- 05, 2024

More Articles