The US Department of Health and Human Services’ (“HHS”) Office for Civil Rights (“OCR”) issued a Notice of Final Determination finding that Cignet Health of Prince George’s County, MD (“Cignet”), violated the Privacy Rule of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). HHS imposed a civil money penalty (“CMP”) of $4.3 million for the violations, representing the first CMP issued by the Department for violations of the HIPAA Privacy Rule. The CMP is based on the violation categories and increased penalty amounts authorized by Section 13410(d) of the Health Information Technology for Economic and Clinical Health (“HITECH”) Act.

In a Notice of Proposed Determination issued October 20, 2010 (“NPD”), OCR found that Cignet violated 41 patients’ rights by denying them access to their medical records. These patients individually filed complaints with OCR initiating investigations of each complaint. The HIPAA Privacy Rule requires that a covered entity provide a patient with a copy of their medical records within 30 (and no later than 60) days of the patient’s request. The CMP for these violations is $1.3 million.

During the investigations, Cignet refused to respond to OCR’s repeated demands to produce the records. Additionally, Cignet failed to cooperate with OCR’s investigations of the complaints, including failure to produce the records in response to OCR’s subpoena. OCR filed a petition to enforce its subpoena in United States District Court and obtained default judgment against Cignet on March 30, 2010. On April 7, 2010, Cignet produced the medical records to OCR, but otherwise made no efforts to resolve the complaints through informal means.

Covered entities are required under law to cooperate with the Department’s investigations. OCR found that Cignet’s failure to cooperate with OCR’s investigations was due to willful neglect. The CMP for these violations is $3 million.