On February 4, 2011, the U.S. Department of Health and Human Services Office for Civil Rights (OCR) imposed a civil money penalty (CMP) of $4,351,600 against Cignet Health of Maryland (Cignet) for violating the Health Insurance Portability and Accountability Act of 1996 (HIPAA) privacy standards. This is the first time OCR has used its CMP enforcement authority under HIPAA. On February 14, 2011, OCR entered into a settlement agreement with Massachusetts General Hospital (MGH) under which MGH agreed to pay $1 million to settle potential violations of the HIPAA privacy standards. Together, the Cignet CMP action and MGH settlement agreement suggest OCR is serious about enforcing HIPAA.

The CMP stemmed from Cignet’s failure to provide 41 patients with copies of their medical records after receiving the patients’ requests for them. Cignet did not respond to any of the 41 individuals’ requests. After receiving a number of complaints, OCR notified Cignet that it had opened investigations into its failure to respond to the individuals’ requests. Cignet failed to respond to OCR’s complaint investigations. As a result, OCR issued a subpoena directing Cignet to produce medical records related to certain of the complaints. Again, Cignet did not respond to the subpoena.

After an additional, unsuccessful attempt by OCR to contact Cignet and obtain the requested medical records, the Department of Justice filed a petition to enforce the subpoena in the U.S. District Court for the District of Maryland. The court scheduled a hearing and ordered Cignet to appear, but Cignet failed to do so and did not defend the action. The court subsequently ordered Cignet to produce the requested medical records. In response to the court’s order, Cignet delivered 59 boxes of original medical records to OCR, which included the requested medical records as well as the medical records for approximately 4,500 other individuals for whom OCR had not requested records.