HHS Imposes a $4.3 Million Civil Money Penalty for Violations of the HIPAA Privacy Rule

HHS imposes a $4.3 million civil money penalty for violations of the
HIPAA Privacy Rule

Action marks first civil money penalty issued by HHS for HIPAA Privacy
Rule violations

The U.S. Department of Health and Human Services’ (HHS) Office for
Civil Rights (OCR) has issued a Notice of Final Determination finding
that Cignet Health of Prince George’s County, Md., (Cignet) violated
the Privacy Rule of the Health Insurance Portability and
Accountability Act of 1996 (HIPAA). HHS has imposed a civil money
penalty (CMP) of $4.3 million for the violations, representing the
first CMP issued by the Department for a covered entity’s violations
of the HIPAA Privacy Rule.

The CMP is based on the violation categories and increased penalty
amounts authorized by Section 13410(d) of the Health Information
Technology for Economic and Clinical Health (HITECH) Act.

“Ensuring that Americans’ health information privacy is protected is
vital to our health care system and a priority of this Administration.
The U.S. Department of Health and Human Services is serious about
enforcing individual rights guaranteed by the HIPAA Privacy Rule,”
said HHS Secretary Kathleen Sebelius.

In a Notice of Proposed Determination issued Oct. 20, 2010, OCR found
that Cignet violated 41 patients’ rights by denying them access to
their medical records when requested between September 2008 and
October 2009. These patients individually filed complaints with OCR,
initiating investigations of each complaint. The HIPAA Privacy Rule
requires that a covered entity provide a patient with a copy of their
medical records within 30 (and no later than 60) days of the patient’s
request. The CMP for these violations is $1.3 million.

During the investigations, Cignet refused to respond to OCR’s demands
to produce the records. Additionally, Cignet failed to cooperate with
OCR’s investigations of the complaints and produce the records in
response to OCR’s subpoena. OCR filed a petition to enforce its
subpoena in United States District Court and obtained a default
judgment against Cignet on March 30, 2010. On April 7, 2010, Cignet
produced the medical records to OCR, but otherwise made no efforts to
resolve the complaints through informal means.

OCR also found that Cignet failed to cooperate with OCR’s
investigations on a continuing daily basis from March 17, 2009, to
April 7, 2010, and that the failure to cooperate was due to Cignet’s
willful neglect to comply with the Privacy Rule. Covered entities are
required under law to cooperate with the Department’s investigations.
The CMP for these violations is $3 million.

“Covered entities and business associates must uphold their
responsibility to provide patients with access to their medical
records, and adhere closely to all of HIPAA’s requirements,” said OCR
Director Georgina Verdugo. “The U.S. Department of Health and Human
Services will continue to investigate and take action against those
organizations that knowingly disregard their obligations under these
rules.”