Clinics fined $4.3 million for HIPAA violations

A Maryland health center is hit with a multimillion-dollar penalty for not sharing records with patients and not cooperating with an HHS investigation.

By — Posted March 7, 2011

Print  |   Email  |   Respond  |   Reprints  |   Like Facebook  |   Share Twitter  |   Tweet Linkedin

For the first time, the U.S. Dept. of Health and Human Services has levied a civil monetary penalty for a violation of the privacy provisions of the Health Insurance Portability and Affordability Act.

Cignet Health Center, a group of clinics based in Prince Georges County, Md., that operates a health plan, has been fined $4.3 million for failing to turn over medical records to patients who requested them and failing to cooperate with the HHS probe.

The case is a reminder to physicians that patients always have a right to see their medical records and that it's essential to cooperate with investigations by HHS or state agencies, said Andrew Wachler, a health care attorney in Royal Oak, Mich.

"To me, if there's a lesson here it is that the respect for patients' entitlement to medical records is significant," Wachler said, suggesting that health workers may have held back records because they might think patients were looking at records "to see if something was done wrong."

The Cignet penalty has caught the attention of health care compliance professionals who closely watch HHS enforcement activities, said Roy Snell, chief executive officer of the Health Care Compliance Assn. based in Minneapolis.

"Effective compliance and privacy officers have been focused on this for a long time," he said. "This is just going to draw renewed attention and focus on this particular segment of the regulation."

The case originated in September 2008 with complaints from patients of Cignet's clinics who wanted to change physicians and asked for copies of their medical records to share with new doctors, according to HHS. The patients told HHS that Cignet refused to hand them over, in violation of HIPAA law. Ultimately, 41 patients complained that they were denied access to their records.

Cignet Practice Administrator Dan E. Austin, MD, did not return phone messages left with staff at the clinic's office.

Rachel Seeger, spokeswoman for the HHS Office of Civil Rights, which enforces HIPAA's privacy rule, said the agency gave the clinic's executives two years to comply with the request to hand over documents and resolve the matter informally.

According to the penalty letter it sent to Cignet, the agency received no response to letters, orders, multiple deadlines and hearings. A February 2010 subpoena and scheduled hearing from U.S. District Court went unanswered, the penalty notice said.

On April 7, 2010, in response to the investigation, Cignet sent 59 boxes of medical records to the U.S. Dept. of Justice, including not only those of the 41 patients who had requested them, but 4,500 other patients whose records should not have been disclosed, the notice said.

But the clinic never offered a defense about its failure to provide those documents earlier or its failure to cooperate with HHS. It was notified of a final determination of the civil monetary penalty in a Feb. 4 letter.

The $4.3 million fine does not include a penalty for those unauthorized disclosures because the office was responding only to the initial patient complaints, Seeger said.

Cignet's failure to respond to the investigation was unprecedented, Seeger said. "We have had investigations with covered entities in the past where there may have been early-on failure to want to cooperate with the investigation, but as you can see, OCR provided multiple and repeated opportunities to resolve this through informal means."

Of the $4.3 million penalty, $3 million is for failing to cooperate with the investigation and $1.3 million is for failing to turn over the medical records requested by patients.

The penalties for HIPAA privacy rule violations were raised under the 2009 Health Information Technology for Economic and Clinical Health Act.

Wachler said the higher fines are a good reason to always respond to HHS inquiries and communications.

"When you ignore a government agency enforcing the law and do not even cooperate to provide them necessary documents, reply to communications or cooperate in any fashion, my experience is that the hammer falls pretty hard," he said.

Dr. Austin's Maryland medical license was revoked on May 24, 2000, after he was convicted of mail and loan fraud stemming from a scheme involving student loans granted to fictitious U.S. residents for attendance at schools outside the country, according to Maryland Board of Physicians records. The order revoking Dr. Austin's license said he was indicted in July 1994 and sentenced to 31 months in prison in 1997.

Back to top



Read story

Confronting bias against obese patients

Medical educators are starting to raise awareness about how weight-related stigma can impair patient-physician communication and the treatment of obesity. Read story

Read story


American Medical News is ceasing publication after 55 years of serving physicians by keeping them informed of their rapidly changing profession. Read story

Read story

Policing medical practice employees after work

Doctors can try to regulate staff actions outside the office, but they must watch what they try to stamp out and how they do it. Read story

Read story

Diabetes prevention: Set on a course for lifestyle change

The YMCA's evidence-based program is helping prediabetic patients eat right, get active and lose weight. Read story

Read story

Medicaid's muddled preventive care picture

The health system reform law promises no-cost coverage of a lengthy list of screenings and other prevention services, but some beneficiaries still might miss out. Read story

Read story

How to get tax breaks for your medical practice

Federal, state and local governments offer doctors incentives because practices are recognized as economic engines. But physicians must know how and where to find them. Read story

Read story

Advance pay ACOs: A down payment on Medicare's future

Accountable care organizations that pay doctors up-front bring practice improvements, but it's unclear yet if program actuaries will see a return on investment. Read story

Read story

Physician liability: Your team, your legal risk

When health care team members drop the ball, it's often doctors who end up in court. How can physicians improve such care and avoid risks? Read story