HHS: First they ignored patients, then ignored us
The $4.3 million civil monetary penalty imposed on Cignet Health in Temple Hills, MD, could have been avoided by simply responding to the reasonable requests of patients for their own medical records, according to the case laid out by the Department of Health and Human Services (HHS).
And even after failing to do that, Cigna could have saved itself a lot of grief by responding to numerous letters from HHS and cooperating with the investigation. Instead, they just kept digging the hole deeper, HHS says.
In a Notice of Proposed Determination issued Oct. 20, 2010, HHS Office for Civil Rights (OCR) found that Cignet violated 41 patients' rights by denying them access to their medical records when requested between September 2008 and October 2009. These patients individually filed complaints with OCR, initiating investigations of each complaint. The HIPAA Privacy Rule requires that a covered entity provide a patient with a copy of their medical records within 30 (and no later than 60) days of the patient's request. The civil monetary penalty for these violations is $1.3 million per incident.
During the investigations, Cignet refused to respond to OCR's demands to produce the records, OCR Director Georgina Verdugo, JD, LLM, MPA, said at a conference. Additionally, Cignet failed to cooperate with OCR's investigations of the complaints and produce the records in response to OCR's subpoena, she said. OCR filed a petition to enforce its subpoena in United States District Court and obtained a default judgment against Cignet on March 30, 2010.
On April 7, 2010, Cignet produced the medical records to OCR, "but otherwise made no efforts to resolve the complaints through informal means," according to HHS documents.
OCR also found that Cignet failed to cooperate with OCR's investigations on a continuing daily basis from March 17, 2009, to April 7, 2010, and that the failure to cooperate was due to Cignet's willful neglect to comply with the Privacy Rule. Covered entities are required under law to cooperate with the department's investigations. The civil monetary penalty for these violations is $3 million. The final determination and penalty was announced Feb. 22, 2011.
A copy of the Notice of Proposed Determination and Notice of Final Determination can be found at http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/cignetpenaltynotice.pdf.
The $4.3 million civil monetary penalty imposed on Cignet Health in Temple Hills, MD, could have been avoided by simply responding to the reasonable requests of patients for their own medical records, according to the case laid out by the Department of Health and Human Services (HHS).You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content