OCR Issues $4.3 Million Fine for Privacy Rule Violation
The Office for Civil Rights has fined Cignet Health of Prince George’s County, MD, $4.3 million for violations of the privacy rule stemming from activities occurring in 2008 and 2009. OCR charged Cignet with violating the rights of 41 patients by denying them access to their medical records. The patients filed individual complaints with OCR, which triggered OCR’s investigation.
Under the privacy rule, covered entities such as Cignet must provide patients with copies of their records within 30 days (and no later than 60 days) of the patient’s request.
The case marks the first civil monetary penalty resulting from a privacy rule violation (though OCR has issued fines in the past). Cignet was charged $1.3 million for refusing to provide the patients with their records. OCR then charged it an additional $3 million for failing to cooperate with the investigation, which it claimed constituted willful neglect of the privacy rule.
The penalty is the first OCR has levied under the heightened penalty structure established by the HITECH Act, which establishes the concept of willful neglect.