The HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Pittsburgh Counselor Fined $15,000 for HIPAA Right of Access Violation

The HHS’ Office for Civil Rights has announced its 44th enforcement action under its HIPAA Right of Access initiative with a $15,000 financial penalty for David Mente, MA, LPC, a licensed counselor that provides psychotherapy services in Pittsburgh, PA.

The HIPAA Right of Access allows individuals to obtain a copy of their health information. Healthcare providers are required to respond to requests and provide the requested records within 30 days of the request being received, although a 30-day extension is possible in certain circumstances. This case stemmed from a complaint from a father of three children who requested a copy of his minor children’s medical records from Mente in December 2017. The complainant was the personal representative of his children and should have been provided with the records as requested.

After receiving the complaint, OCR contacted Mente, provided technical assistance on the HIPAA Right of Access, and closed the complaint. The father made a second request for a copy of the records in April 2018; however, Mente again failed to provide the requested records, despite having received technical assistance from OCR. That led to the father filing a second complaint with OCR.

OCR reopened the case and determined that the failure to provide the requested records was a potential violation of the HIPAA Right of Access. Mente chose not to contest the proposed penalty and settled the case with OCR.  In addition to the financial penalty, Mente agreed to adopt a corrective action plan to address the noncompliance. The corrective action plan includes the requirement to review and revise policies and procedures for individual access to PHI, to provide privacy training to the workforce on individual access to individuals’ PHI, and to make a good faith effort to provide the complainant with the requested records or to deny access, in whole or in part, consistent with 45 C.F.R. 164.524(3).

Get the FREE
HIPAA Compliance Checklist

Delivered via email so please ensure you enter your email address correctly.

Your Privacy Respected

HIPAA Journal Privacy Policy

This is the third financial penalty to be imposed by OCR in 2023 to resolve potential violations of the HIPAA Rules and follows on from a $1,250,000 settlement with Banner Health and a $16,500 settlement with Life Hope Labs LLC.

“Under HIPAA, parents, as the personal representatives of their minor children, generally have a right to access their children’s medical records,” said OCR Director Melanie Fontes Rainer. “It should not take an individual or their parent representative nearly six years and multiple complaints to gain access to patient records.  HIPAA-regulated entities should be proactive and work to ensure patients and their representatives can access records.”

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.


Is Your Organization HIPAA Compliant?

Find Out With Our Free HIPAA Compliance Checklist

Get Free Checklist