The U.S. Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) has imposed its first civil monetary penalty since the Privacy Rule of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) became effective in April 2003. HHS issued a Notice of Final Determination finding that Cignet Health of Prince George’s County, Md., (Cignet) violated the Privacy Rule and imposed $4.3 million in penalties for the violations. The penalty amount is based on the increased penalty amounts authorized by Section 13410(d) of the Health Information Technology for Economic and Clinical Health (HITECH) Act.

In a Notice of Proposed Determination issued Oct. 20, 2010, OCR found that Cignet violated 41 patients’ rights by denying them access to their medical records when requested between September 2008 and October 2009. These patients individually filed complaints with OCR, initiating investigations of each complaint. The HIPAA Privacy Rule requires that a covered entity provide a patient with a copy of their medical records within 30 (and no later than 60) days of the patient’s request. The penalty for these violations is $1.3 million.

During the investigations, Cignet refused to respond to OCR’s demands to produce the records. Additionally, Cignet failed to cooperate with OCR’s investigations of the complaints and produce the records in response to OCR’s subpoena. OCR filed a petition to enforce its subpoena in United States District Court and obtained a default judgment against Cignet on March 30, 2010. On April 7, 2010, Cignet produced the medical records to OCR, but otherwise made no efforts to resolve the complaints through informal means. When Cignet did produce the records, it included certain records of 4,500 unrelated patients.

OCR also found that Cignet failed to cooperate with OCR’s investigations on a continuing daily basis from March 17, 2009, to April 7, 2010, and that the failure to cooperate was due to Cignet’s willful neglect to comply with the Privacy Rule. Covered entities are required under law to cooperate with the Department’s investigations. The penalty for these violations is $3 million.

There are some important lessons from this case for covered entities and business associates (now subject to the same penalty provisions as covered entities):

• HHS appears to have turned the corner – it is willing to impose substantial penalties for Privacy and Security Rule violations under HIPAA.
• Each day that a violation continues can be treated as a separate violation, allowing penalties to add up quickly. Cignet’s failure to provide a patient timely access to his records was a violation, and each day that continued was a separate violation. 
• When responding to an HHS investigation concerning patient or participant information, be sure to include only the information being requested, and not that of unrelated persons.
• Most important, be responsive to the agency. The reason for the significance of the penalties was almost certainly due to Cignet’s level of cooperation HHS.