On March 28, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced four new enforcement actions against healthcare providers for HIPAA violations. Two of the actions were part of OCR’s HIPAA Right of Access Initiative which has been ongoing since 2019.

Three of the actions were against dental practices. In one, a solo dental practitioner in Butler, Pennsylvania agreed to pay $30,000 and implement new HIPAA training practices after failing to provide medical records that a patient requested. In another action, the owner of an Alabama dental practice gave an Excel spreadsheet with the names and addresses of 3,657 patients to his campaign manager, who mailed letters to the patients announcing the dentist’s run for state senate. The following year, the dentist hired a third-party marketing company to send emails to 5,385 patients for the same reason. The practice agreed to a $62,500 penalty for violating the HIPAA Privacy Rule.

The third HIPAA-violating dental practice got off easy with a $50,000 civil penalty. The North Carolina practice responded to a patient’s negative review on Google using the patient’s full name, providing specific details about his treatment, and closing with the suggestion that he “get a life.” After the patient complained to OCR, OCR asked the practice numerous times for information on the incident, without a response. The consequences could have been much worse.

The fourth action was a Right of Access settlement with a California psychiatric provider for a rather extreme violation of the HIPAA Privacy Rule. The practice agreed to pay a $28,000 penalty and implement a corrective action plan after repeatedly failing to respond to a patient’s request for medical records. The patient mailed letters to the practice requesting the records on July 1 of each year from 2013 to 2018, but never received a response. She finally received the records in 2019 after traveling to the office and paying a fee, but (properly) complained to OCR.