Dentists See a Record-Setting Year for HIPAA Enforcement Action

HIPAA enforcement actions have been brought against dentists more than any other covered entity so far this year, requiring dentists to become more aware of their responsibilities under the law. DOCS Education legal counsel, J. Kathleen Marcus weighs in.

By J. Kathleen Marcus, Esq.

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) remains one of the most misunderstood federal health laws. However, as part of increased enforcement of HIPAA by the HHS Office of Civil Rights (OCR), three more dentists have been sanctioned for failure to timely produce medical records upon patient request.

Honoring Patient’s Requests for Records

Under the HIPAA Privacy Rule, covered entities (which includes all healthcare providers) must give patients (or the parents of minor patients) medical records within thirty calendar days of a written request. Patients have a right to all medical records including billing and payment records, insurance information, clinical laboratory test results, medical images, such as X-rays, and clinical case notes. While HIPAA requires that the request by the patient is in writing and that the provider takes “reasonable” steps to verify the identity of the person making the request, healthcare providers may not require that the patient pick up the records at the office, use a web portal to access the records, or mail a release to the provider for the records.

The provider must also produce the records in the form requested – paper if paper is requested, and electronically if electronic records are requested.

Healthcare providers can charge for the production of the records but only the actual cost of paper and labor – no surcharge whatsoever.

Non-compliance Equals Fines

This latest OCR press release announced that a Chicago dental office would pay $30,000 for taking five months to provide the requested records. In addition, a Georgia dental office must pay $80,000 for taking a year to produce records for a former patient and a Nevada dental office will pay $25,000 for taking a year to produce a child’s records to the requesting parent.

Regarding these cases, OCR Director Melanie Fontes Rainer stated, “Patients have a fundamental right under HIPAA to receive their requested medical records, in most cases, within 30 days. I hope these actions send the message of compliance so that patients do not have to file a complaint with OCR to fulfill their medical records requests.”

Record-Setting Enforcement

These cases are the latest in a record-setting year of HIPAA enforcement actions. More HIPAA enforcement actions this year have been brought against dentists than any other covered entity, calling attention to the need for dentists to be aware of their obligations under HIPAA and the hefty fines that can result from failing to comply.

The American Dental Association (ADA) has created a "Tip Sheet on Certain Provisions of the HIPAA Privacy Rules" for further formation. DOCS members can direct HIPAA questions to me at: [email protected].

Author: J. Kathleen Marcus, Esq. is General Counsel for Strategic Dentistry and Regulatory Counsel for DOCS Education.

DOCS Membership

Upcoming Events
February 24- 25, 2023
March 10- 11, 2023
May 19- 20, 2023

More Articles