Skip to content

$4.3 Million Penalty for Violating HIPAA/HITECH Privacy Rule

by Lauren M. Nelson, JD on February 25th, 2011

The Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) issued the first ever civil money penalty (CMP) for a covered entity’s violation of HIPAA’s Privacy Rule and it is rather substantial – $4.3 million. The OCR found that Cignet Health (Cignet) violated HIPAA’s Privacy Rule by denying patients access to their medical records and by refusing to cooperate with the OCR investigation.

Throughout the OCR’s investigation into patients’ complaints, Cignet refused to produce records to the OCR, failed to cooperate with the investigation, and refused to produce records in response to subpoena. Only after the OCR obtained a default judgment to enforce the subpoena did Cignet produce medical records. The OCR found that Cignet failed to cooperate with the investigation on a continuing daily basis from March 2009 to April 2010. By law, covered entities are required to comply with the HHS’s investigations. Cignet’s failure to cooperate was considered to be willful neglect to comply with the HIPAA Privacy Rule.

The OCR found that Cignet violated 41 patients’ rights by denying the patients’ access to their medical records when requested. In October of 2010, Cignet was provided a Notice of Proposed Determination informing it of the proposed CMP and of Cignet’s right to request a hearing on the proposed CMP. Cignet failed to do so. The OCR issued the Notice of Final Determination with the civil money penalty of $4.3 million on February 4, 2011.

The $4.3 million penalty was based on the violation categories and increased penalty amounts authorized by Section 13410(d) of the HITECH Act. Cignet’s failure to cooperate with the OCR’s investigation cost it $3 million. Failing to provide its patients with a copy of their medical records resulted in a $1.3 million penalty.

See the HHS press release and the OCR press release for additional information.

Share and Enjoy:
  • Twitter
  • Facebook
  • Google Buzz
  • LinkedIn
  • Google Bookmarks
  • email

From → Health Law