Clinics fined $4.3 million for HIPAA violations

For the first time, the U.S. Dept. of Health and Human Services has levied a civil monetary penalty for a violation of the privacy provisions of the Health Insurance Portability and Affordability Act.

Cignet Health Center, a group of clinics based in Prince Georges County, Md., that operates a health plan, has been fined $4.3 million for failing to turn over medical records to patients who requested them and failing to cooperate with the HHS probe.

The case is a reminder to physicians that patients always have a right to see their medical records and that it's essential to cooperate with investigations by HHS or state agencies, said Andrew Wachler, a health care attorney in Royal Oak, Mich.

"To me, if there's a lesson here it is that the respect for patients' entitlement to medical records is significant," Wachler said, suggesting that health workers may have held back records because they might think patients were looking at records "to see if something was done wrong."

The Cignet penalty has caught the attention of health care compliance professionals who closely watch HHS enforcement activities, said Roy Snell, chief executive officer of the Health Care Compliance Assn. based in Minneapolis.

"Effective compliance and privacy officers have been focused on this for a long time," he said. "This is just going to draw renewed attention and focus on this particular segment of the regulation."

The case originated in September 2008 with complaints from patients of Cignet's clinics who wanted to change physicians and asked for copies of their medical records to share with new doctors, according to HHS. The patients told HHS that Cignet refused to hand them over, in violation of HIPAA law. Ultimately, 41 patients complained that they were denied access to their records.

Cignet Practice Administrator Dan E. Austin, MD, did not return phone messages left with staff at the clinic's office.

Rachel Seeger, spokeswoman for the HHS Office of Civil Rights, which enforces HIPAA's privacy rule, said the agency gave the clinic's executives two years to comply with the request to hand over documents and resolve the matter informally.

According to the penalty letter it sent to Cignet, the agency received no response to letters, orders, multiple deadlines and hearings. A February 2010 subpoena and scheduled hearing from U.S. District Court went unanswered, the penalty notice said.

On April 7, 2010, in response to the investigation, Cignet sent 59 boxes of medical records to the U.S. Dept. of Justice, including not only those of the 41 patients who had requested them, but 4,500 other patients whose records should not have been disclosed, the notice said.

But the clinic never offered a defense about its failure to provide those documents earlier or its failure to cooperate with HHS. It was notified of a final determination of the civil monetary penalty in a Feb. 4 letter.

The $4.3 million fine does not include a penalty for those unauthorized disclosures because the office was responding only to the initial patient complaints, Seeger said.

Cignet's failure to respond to the investigation was unprecedented, Seeger said. "We have had investigations with covered entities in the past where there may have been early-on failure to want to cooperate with the investigation, but as you can see, OCR provided multiple and repeated opportunities to resolve this through informal means."

Of the $4.3 million penalty, $3 million is for failing to cooperate with the investigation and $1.3 million is for failing to turn over the medical records requested by patients.

The penalties for HIPAA privacy rule violations were raised under the 2009 Health Information Technology for Economic and Clinical Health Act.

Wachler said the higher fines are a good reason to always respond to HHS inquiries and communications.

"When you ignore a government agency enforcing the law and do not even cooperate to provide them necessary documents, reply to communications or cooperate in any fashion, my experience is that the hammer falls pretty hard," he said.

Dr. Austin's Maryland medical license was revoked on May 24, 2000, after he was convicted of mail and loan fraud stemming from a scheme involving student loans granted to fictitious U.S. residents for attendance at schools outside the country, according to Maryland Board of Physicians records. The order revoking Dr. Austin's license said he was indicted in July 1994 and sentenced to 31 months in prison in 1997.