Pittsburgh Counselor Fined $15,000 for HIPAA Right of Access Violation
The HHS’ Office for Civil Rights has announced its 44th enforcement action under its HIPAA Right of Access initiative with a $15,000 financial penalty for David Mente, MA, LPC, a licensed counselor that provides psychotherapy services in Pittsburgh, PA.
The HIPAA Right of Access allows individuals to obtain a copy of their health information. Healthcare providers are required to respond to requests and provide the requested records within 30 days of the request being received, although a 30-day extension is possible in certain circumstances. This case stemmed from a complaint from a father of three children who requested a copy of his minor children’s medical records from Mente in December 2017. The complainant was the personal representative of his children and should have been provided with the records as requested.
After receiving the complaint, OCR contacted Mente, provided technical assistance on the HIPAA Right of Access, and closed the complaint. The father made a second request for a copy of the records in April 2018; however, Mente again failed to provide the requested records, despite having received technical assistance from OCR. That led to the father filing a second complaint with OCR.
OCR reopened the case and determined that the failure to provide the requested records was a potential violation of the HIPAA Right of Access. Mente chose not to contest the proposed penalty and settled the case with OCR. In addition to the financial penalty, Mente agreed to adopt a corrective action plan to address the noncompliance. The corrective action plan includes the requirement to review and revise policies and procedures for individual access to PHI, to provide privacy training to the workforce on individual access to individuals’ PHI, and to make a good faith effort to provide the complainant with the requested records or to deny access, in whole or in part, consistent with 45 C.F.R. 164.524(3).
Get the FREE
HIPAA Compliance Checklist
Delivered via email so please ensure you enter your email address correctly.
Your Privacy Respected
HIPAA Journal Privacy Policy
This is the third financial penalty to be imposed by OCR in 2023 to resolve potential violations of the HIPAA Rules and follows on from a $1,250,000 settlement with Banner Health and a $16,500 settlement with Life Hope Labs LLC.
“Under HIPAA, parents, as the personal representatives of their minor children, generally have a right to access their children’s medical records,” said OCR Director Melanie Fontes Rainer. “It should not take an individual or their parent representative nearly six years and multiple complaints to gain access to patient records. HIPAA-regulated entities should be proactive and work to ensure patients and their representatives can access records.”
