Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Washington, D.C.

On September 20 the U.S. Department of Health and Human Services Office for Civil Rights (OCR) <a href="https://www.hhs.gov/about/news/2022/09/20/ocr-settles-three-cases-dental-practices-patient-right-access-under-hipaa.html" target="_blank" rel="noreferrer noopener">announced</a> the resolution of three investigations of dental practices concerning violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule’s patient right of access requirements (<a>45 C.F.R. § 164.524</a>) (“right of access rules”).

contentpilot/introduction

The violations consisted of failing to provide patient dental records in a timely manner and charging more than reasonable cost-based fees for the records.

core/paragraph

One of the dental practices failed to provide a former patient with timely access to her complete dental records by initially providing only portions of the records and completing the request more than five months after the request was made. The practice agreed to pay $30,000 and implement a corrective action plan.

Another dental practice refused to provide copies of a patient’s dental records until she paid a $170 copying fee. The patient did not receive her records until more than a year after she requested them. The OCR determined that the practice did not provide timely access to the requested dental records and that the copying fee was not reasonable and cost-based, both of which violated the right of access rules. The practice agreed to pay $80,000 and implement a corrective action plan.

A third dental practice failed to provide a mother with copies of her and her minor child’s dental records. The mother submitted multiple records requests, but the practice did not send the records until more than eight months after her initial request. The practice agreed to pay $25,000 and implement a corrective action plan.

Under HIPAA’s right of access rules, patients have the right to inspect and obtain a copy of their medical or dental records. With certain exceptions, medical records in a “designated record set” must be provided. These include medical records, billing records, and records used by a covered entity to make decisions about individuals. A medical or dental practice must act to provide the records within 30 days after it receives the request, unless the practice is unable to take action within such time, in which case the practice may extend the time for such action by no more than 30 days as long as it notifies the patient of the reasons for the delay and the date by which the covered entity will complete its action on the request.

The records must be provided in the form and format requested by the patient if they are readily producible in such form or format. For example, if the patient information is maintained electronically and the patient requests an electronic copy of the information, the practice must provide an electronic copy of the records.

If a patient’s request for records directs the practice to transmit the medical or dental records directly to another person designated by the patient, the practice must provide the copy to the designated person.

The practice may charge a reasonable, cost-based fee, as long as the fee includes only the cost of labor for copying the medical records requested by the patient, supplies for creating the paper copy or electronic media if the electronic copy be provided on portable media, and postage.

Under certain circumstances, the practice may deny a request to access medical records as long as the practice complies with requirements set forth in the regulations.

The OCR previously has issued <a href="https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html" target="_blank" rel="noreferrer noopener">guidance</a> on the patient right of access regulations. All medical or dental practices should timely respond to patient requests for medical or dental records and limit the fees charged for complying with the request to reasonable, cost-based fees. In its press release, HHS noted that the three actions send an important message to dental practices of all sizes that are covered by the HIPAA rules to ensure they are following the law.

<em>This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.</em>

<em>This document may be considered attorney advertising in some jurisdictions.</em>

https://admin.thompsonhine.com/wp-content/uploads/2022/11/Health-Care-Law-Update-OCR-Actions-Involving-Dental-Practices-Highlight-Patient-Right-of-Access-Obligations.pdf

OCR Actions Involving Dental Practices Highlight Patient Right of Access Obligations

Services