The Compliance Divas Podcast
Our podcast covers current topics such as infection prevention and control, OSHA and HIPAA compliance for dentistry. We discuss the latest regulatory information, answer frequently asked questions and give suggestions for dental practices to make compliance easy and sustainable. The Compliance Divas are a trusted source for consistent, accurate information based upon current guidelines, standards, science, and recommendations.
The Compliance Divas Podcast
#82 Six Dental Practices Fined by HIPAA
Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.
Not responding to patient requests for records within the legally required time frame is a HIPAA violation. While most offices have good intentions to release records, they frequently become confused how to handle a request when the patient has a balance. Check out this episode to ensure you avoid a patient complaint to the Office of Civil Rights for not releasing records or overcharging for copies of records.
- Office for Civil Rights (OCR) Settles Three Cases with Dental Practices for Patient Right of Access under HIPAA https://www.hhs.gov/about/news/2022/09/20/ocr-settles-three-cases-dental-practices-patient-right-access-under-hipaa.html
Welcome. I'm Leslie Cannon. I'm Mary Gavoni.
SPEAKER_02I'm Linda Harvey. I'm Olivia Wan. And together we are the Compliance Divas.
SPEAKER_03Welcome to this episode of the Compliance Divas podcast. My name is Linda Harvey. I'll be serving as the moderator for this episode. In today's podcast, the Divas will discuss patient rights to their records under the HIPAA laws. And please remember we bring clarity and simplicity to compliance by navigating regulatory compliance to keep you on course. And any resources mentioned during this podcast may be found on our website, thecompliancedivas.com. And we invite you to submit any questions to support at thecompliancedivas.com. HIPAA privacy rule grants and ensures patients' rights to access their records. This law has been in effect since 2003. However, there's still a great deal of confusion and misunderstanding about releasing records to patients. So today the Divas are specifically going to speak about an Office of Civil Rights initiative that launched in 2019, and it's called the Right to Access. The purpose of the Right to Access Initiative is to enforce an individual's rights to access their health information in a quick and easy way. Since this initiative was launched, the Office of Civil Rights has fined 25 healthcare facilities and private practices for not releasing records to a patient within the legally required time frame. That may not sound like a large number of facilities in these past several years, but think about this. The total of all their fines was more than $1.4 million. The smallest fine was $3,500, and the largest fine was $200,000. So let's discuss what this patient right means under HIPAA for your dental practice. Leslie, can I call on you first? What information is included in the right to access? And is there anything that's excluded in this right? And talk to us about maybe the chart notes and in-office notes and anything else about the patients in the record, if you don't mind.
SPEAKER_00Certainly, Linda. You know, patients do have a right to access their own protected health information in what's called a designated record set. And a designated record set is defined as a group of records maintained by or for a covered entity, and dentists are in most cases covered entities, that comprises whether it's the dental records, billing records, uh, and any information about an individual that's maintained by the dentist. Sometimes that extends to other information like insurance, like, for example, enrollment and payment and claims of judification, as well as case or medical management record systems maintained by or for a health plan. So sometimes records are used in whole or in part by a covered entity to make decisions about their individuals that they are treating. So the term records, as you had asked me to explain, is really any item or collection or grouping of information that includes protected health information and is maintained, collected, used, or disseminated by or for a covered entity. So everything in a patient's chart, whether it's images, chart notes, billing records, it can be lab slips, uh, just anything that pertains, sometimes people will consider to be their study models or cast impressions of their of their teeth considered to be part of the uh records that they might want to have a copy of. And uh patients uh have a right to a broad array of health information about them and themselves that are maintained by covered entities. So any information that we uh provide for a patient or that we collect uh for our own records on a patient is part of that information that they can request. So mentioning again billing records, payment records, insurance information, clinical or lab tests, uh medical images, x-rays, uh, wellness and disease management and program files or case notes and other information used to make decisions about individuals. So, in response to a request for access, a covered entity or a dentist is not required to create new information such as explanation or materials or analysis that are not already in the designated record set. Patients have rights to their records. Now, there are some items that are excluded from rights to access. So a patient does not have a right to access PHI that is not part of a designated record set because the information is not used to make decisions about that individual. That might include things like quality assessment or improvement records, or patient safety activity records, or business planning and development and management records that are used for business decisions more generally than rather to make decisions about an individual. That might be, for example, a peer review situation, or if there's an audit, a dental practice may be audited by an insurance company. And uh I know in some cases there may be larger corporations where a dentist's performance may be audited for uh seeing how they're doing within the practice. And so those kinds of notes are not considered to be part of the patient's uh record set. Um, in addition, there's two more categories of information that are explicitly excluded from the right of access, and that would include psychotherapy notes, which likely we would not have in our patient chair, but we may have conversations with our patients and uh you know, like a bartender might or a managerist might have with their patient, we do develop a nice relationship with our patients. And so typically we're not uh performing psychotherapy, and then information that's compiled in a reasonable anticipation for use in either a civil, criminal, or administrative action proceeding. So I hope that explains not only the right to access and the designated record sets, but also what's excluded.
SPEAKER_03Thank you, Leslie. That is so extensive when you think about all the things that are comprising a patient's record in a dental office. It just is a good reminder to our listeners that when patients are requesting information, they may only want a copy of their last x-rays or something simple or a copy of an EOB. So it's pretty straightforward, but yet they have the right to have access to a wealth of other information. So thank you for bringing all those points to light. Mary, let's talk about the uh request for access for just a moment. And do offices have to obtain a written request and should they verify who's requesting the records? What are your thoughts on this?
SPEAKER_01Well, there's a whole lot of thoughts that I have on this one. One, it just goes back to basic um HIPAA privacy compliance that the HIPAA privacy rule states that a covered entity, which would be a dental practice, has the responsibility to establish a health care record for an appropriate person. So if you have a new patient coming into your practice and you don't know them, you've not met them before, you need to be validating that they are who they say they are by requesting to see a photo ID. And very, very few dental practices actually do that. And it's not something that's foreign to patients because they have to do it in many cases every time they access medical services. So for new patients, absolutely for established patients, what I tell folks is just go through all your patients as they come in. If you haven't been verifying identity and say we're updating our records and we need to see a copy of your photo ID or we need to make a copy of your photo ID, and then you can scan it into their record or make a photocopy and save it. But that's number one. They have to establish their identity. If it's a minor child, then you establish the identity of the parent. If a patient comes to the office in person, you don't necessarily have to have them sign a form or complete a form requesting access, but it's a good idea so that you have documentation, not only that they want access, but what they want access to. So if they want access to treatment records for a particular tooth or a particular type of treatment, as opposed to they want copies of all of their clinical information. So we can differentiate there. If the person requesting the information is a personal representative, then absolutely you need to have it documented and you need to know that you have the patient's permission for that person to have access to that information. And I always encourage my practices that I work with to get that information on their HIPAA acknowledgement form. Always ask for the names of people that you can discuss or disclose their treatment to. So a good example of this might be an elderly patient whose adult child has asked for access to the records. First of all, if the parent has or the patient has given permission, then they just need to verify their identity and they can have access to the records. But then we also have many requests that come either on the phone or perhaps by email. And there are other issues that we need to work with, certainly having forms that could be faxed or emailed to that requester that they can send back to us. But know that when it has personal information, it must be sent through secure email. There are security issues that that apply. And you have 30 days at this point in time to comply with that request. So you can't just sort of set it aside and say, yeah, when I get to it, you need to pay attention to those requests. So not only should you have a form pre-prepared that you can have the either the patient or the requester complete for access to that information, you need to keep a log of those requests as well so that you can document what is um what is being requested. The other thing to know is that if you have a patient that requests access to their records and they have an unpaid balance on their account, you may not restrict access to that information. That is illegal. And you cannot make payment of their unpaid balance in full a contingency for you releasing the records. I know it's not fair. Um, and a lot of times if they want access to their records, it might mean that they're leaving your practice, but you have to grant them access within 30 days as long as it meets the requirements. It's a reasonable request, and you can charge a fee for copying records, but it can't be equivalent, for example, to the $200 unpaid balance they have on their account. And again, it's not a fair thing, but it is the reality.
SPEAKER_03Thank you, Mary. That reality is just jumping front and center because we all have seen so many stories, either among our clients and on social media of offices that didn't produce them. And um another office manager will make a post and say, How what do I do here? Um, you know, can't get records from the previous office. But I like what you said about um I verifying identities, either one, updating your patient records to get a copy of their driver's license and validating who's coming in. Because there's two points about identities that I want to make here. One is identity theft. With the explosion of ransomware and patient data and consumer data being sold everywhere, identity theft is a problem. And it's been a huge consumer complaint to the Federal Trade Commission for over a decade. So it's a big issue. And then, two, identity comes into place when there's ever, if there's ever, a forensics issue where the dental practice has to furnish x-rays or information on a deceased person in order to validate an identity. I think that's few and far between. Thank goodness. You just want to be prepared in that onset. I also like what you said about the HIPAA acknowledgement form, making that multifunctional. Um, and we do the same thing. We want to know how do they want to be contacted with up front and who can we talk to about their care. Um, Marin, what you'd have a follow-up comment?
SPEAKER_01I do. One thing that I wanted to mention as well, it's not just verifying identity when that patient comes into the practice, you also should be verifying identity on the phone. Now, we know so many of our patients, we see them on a regular basis, but the common practice in the medical profession, um, whether it's a physician practice or a hospital setting or a pharmacy, is that you verify your date of birth. So, although it's a little off-putting when I call my physician's office and I say who I am, and I know they know me, but they always request, Mary, will you please verify your date of birth so that you know that number one, they're accessing the right record, but they're verifying that I am who I say I am. And that's an important thing. It's a habit to get into. A lot of practices don't like to do it, but we just simply tell them we're just trying to protect your privacy.
SPEAKER_03Oh, Mary, that's perfect because it's all about the patient. Anytime we can explain it so that it's all about the patient, we're protecting your identity. That's when we need to signature on file, or we need to verify this document, or we need to ask you that. And also, secondarily to that, it's how the team member asks that information. I'm like you, I have a very common name, Linda Harvey's two common first name, common last name. And uh, there are other people with the same name. So it behooves me to want to be asked those questions. And I think it's very helpful for our clients as well. Olivia, let's talk for a moment about what constitutes unreasonable measures and what is the timeliness required for providing access to patients to their records.
SPEAKER_02Sure, Linda. So we want to make the process as easy and simple as possible and avoid the allegation that we made that process unreasonable measures to retrieve. So, for example, I'm looking at online how to make a medical records request of a hospital in Nashville. And they've beautifully laid it out that to make a records request, you download the authorization form, whether that's English or Spanish, you complete it, and then they provide email address, two different fax numbers, and even a mailing address. And if you still have questions, there's a half a dozen phone numbers where you could reach out to discuss this medical records request. And so it makes that process very easy and streamlined. So we too in dental offices should make the process easy. And remember, the time clock is clicking. As Mary pointed out, on a federal level for HIPAA, we have 30 calendar days to provide a copy of the record. So from the time they request it, we have 30 days. But let's not forget state law. So an example would be Tennessee, where I live in practice. We look at what Tennessee's requirement is for a medical records request. We look at Title 63, Chapter 2. So that's 63-2-101 release of medical records. It's 10 working days. So we don't have the time that we think that we do on a federal level. So it shortens it down to 10 days. So I think what's happened, Linda, in the medical world, there were so many undue delays caused because maybe it were a workers' comp issue that was being addressed and the physician practices weren't supplying the information, or maybe it was a personal injury case. Same thing. They could not get their hands on the records in a timely manner, which resulted uh in undue delays for the patient and could risk harm to the patient, but also in um monetary damages as well. So we want to avoid unreasonable measures, making it very simple for a patient to request a copy of their record. And uh, as Mary pointed out, we want if somebody else is picking up the record, which I've had that question from dental offices where an elderly person requested the record, maybe there were failed implants, and the adult daughter was going to pick up the record. So my suggestion was what she needs to verify her identity. We don't have to make a copy of the driver's license because that's one more thing we have to protect, but have that person produce ID so we verify identity and we provide the information in a sealed envelope. So, Linda, I hope that addresses this first part of your question.
SPEAKER_03That was perfect, Olivia. So thank you for reminding us that state law is important as well. In Florida, it happens to be 30 days. So ours pretty much matches up to you know the federal law, but states like Tennessee, and I don't know about our other divas, it's very important that you not violate state law. So you can't just automatically default to, you know, the federal law if your state law is more um more stringent. And I think one thing that happens in the medical world for records not being released in as timely of a fashion is the complexity of those records and the volume of them that you were indicating. Um, I have experience working in the medical world, and I know with all the different types of specialties to get all those records together, whereas in a dental practice, we may have referred the patient to specialties, but at least it's all referred all to the oral cavity, not different body parts and different areas of specialties. Um, and then the other point you made, I think, is just make it easy. You and Mary said the same thing. Let's make it easy for the patient to get that information. How do they get the form? Is it on your website? Um, can they quickly get it? Can you email it to them? And this and then validate, validate, down, validate when it comes to their people's identities, who's coming. But no, again, we cannot withhold the records because there is a balance. And we'll talk more about that in our round robin because I know we all have more experiences in that area. But right, Livby, I'd like to ask you a follow-up question though. Let's take a scenario when an office does not release records within the time frame and the patient files a complaint. Can you just run us through that really quickly? And then how would the Office of Civil Rights determine what the settlement amount would be?
SPEAKER_02We look at some of the examples, Linda, on the Department of Health and Human Services website, and that really helps us understand how this process works out. Matter of fact, they provided some examples. Advanced Spine and Pain Clinic, they actually reached a settlement, which means they negotiated and the clinic actually did not admit liability. So it was resolved without admitting liability. And in this particular example, the patient requested copies of the record November 25th, 2019. They still had not had them in March of 2020. And the resolution that was reached, meaning that that's what the covered entity agreed to pay for this mishap, was $32,150. This is a very expensive way to deal with a delay in providing a copy of the record. There was another covered entity in Denver and similar complaint where the patient requested a copy of a record, and months later they still did not have a copy. So there was an agreement reached where there was no admission of liability of the covered entity's part, but obviously they didn't provide the record. And so they agreed to the payment of $30,000 for this problem and not complying. So we want to be sure that the timely request is uh is made, but also fulfilling that request with the medical record to avoid a fine. You know, anytime you see a settlement, that's what the party, the party agreed to, and it's an expensive way to address a patient complaint. So I think we need to handle it on the front end, on making sure we handle it timely. Oh, Olivia, that's so beautifully said.
SPEAKER_03It's an expensive way of learning that you do not delay patients' rights to the records. And whether that's an ego issue or whether it's because you don't think the patient they didn't pay their balance and you're annoyed at them. Uh, we can't let our own emotions and feelings um, you know, cover that and kind of cloud our good judgment and what we're supposed to do, because otherwise it does come back. Um, just a quick example of an office we worked with for a while in the New England area, multi specialty practice. And so one of the pediatric patients was transferring to another office, and the mother had requested the records. And this was about December of one year. And then January, February, March, the mom had called several other times and kept saying the records aren't at the new office. What's going on? And finally, I got into the picture. They finally called me and I said, somebody needs to drive a copy of those records over to the new office today. You need to get this taken care of, ASAP. So they resolved that. They got the records. I'm not sure whether it was the wrong address or what the mix-up was now. But the mother then exercised her right to file a complaint with the Office of Civil Rights. And about two months later, the client got a letter in the mail from OCR. It was no reprimand, no fines, but just reminding them that this is what the allegation was, this is what they're required to do, and don't let it happen again. So it's very significant. They were lucky they got off with that. But what if that parent had decided to file a complaint with the Board of Dentistry? And I think in most uh states that's a violation of the Dental Practice Act. At least I know in Florida. Devas, I don't know about your states, but we have some issues to consider. So does anybody have any stories you'd like to share with our listeners to help them kind of tease apart any scenarios or situations that they may encounter in their practice?
SPEAKER_00Leslie. Thank you, Linda. I had a client who was charging a fee for X-rays to be duplicated for patients who came in and had x-rays and full mouth and cleaning. He had advertised a special price for that. And he found that people were coming in for that special deal, but then they were asking for their records to be sent somewhere else. So he was charging a $75 fee for the release of records. And he actually posted that in the patient treatment room to discourage them from requesting their records to go somewhere else. And I explained to him that, well, in California, we have some limitations on how much can be charged. But uh, whether you're in California or in another state, still HIPAA federal regulations apply. And you can really only charge the laborer to make a copy, whether it's paper or electronic, any supplies such as electronic media, postage when the patient requests that a copy be mailed, and time to prepare an explanation or summary of record if it's requested by the patient. So, you know, to charge a very large fee like that would certainly uh trigger, if a patient did make a complaint to health and human services, would certainly trigger an investigation.
SPEAKER_03It certainly would, Leslie. And that reminds me of a Facebook post I saw probably a couple of years ago now where an office manager was having a situation with a new patient who wanted to come into their practice. And the former office was chart wanting to charge $75 for the x-rays. And just like that patient, this this one had gone in on a free special or discounted special to this office and wanted to go for a second opinion. And uh sometimes offices mistakenly feel like since the patient didn't pay for it, either one, they're going to charge them something uh significant, or two, that the patient does not have a right to that information because they did not pay for it. And that is not the case either. So I would not want to make a test um case out of that by denying patients their records. Um, it's an expensive lesson in the end, as Mary Olivia has mentioned, and Mary as well. Mary, you have some additional thoughts to share?
SPEAKER_01I do. Um, one of the things that we didn't mention, besides the patient's right to access their records, there is a provision in the HIPAA privacy rules that they can ask for an amendment to their records. Now, that can be denied by the provider, especially if the request is unreasonable, like changing treatment dates or description or coding of treatment and so forth. But if something is written in a way, perhaps in clinical notes that might be objectionable to the patient, they can make a request in writing to have that changed. So I always caution all the folks that I work with to be very careful. And you should be from a risk management standpoint, um, as you well know, um, Linda, the risk management diva, um, that you need to be very careful how you document that things are very um precise. If you just write in the record difficult patient, that could be objectionable to a patient. We all know we have difficult patients. We know what makes them difficult, but what you need to do is document what is difficult about them related to their treatment. Um I still see every now and then patients who write the acronym P-I-T-A in a clinical record. And that is so not appropriate. Um put it in notes somewhere else, or you know, that's the your the your inside voice that says that, but be very, very careful that what you write is true and it's objective about what um what you're trying to describe in your in your treatment records. But no patients have the right to ask that you change something that they object to in their records.
SPEAKER_03So true, Mary. Thank you for bringing up that point. And I would probably classify that as one of the little known rights that patients may not be aware of. And it sounds like that we could do a podcast on that in the future, as well as including some of the other areas, such as what does the Office of Civil Rights say you can actually charge for patient records? So $75 is not one of those reasonable areas, as Leslie said. So today I'd like to thank our listeners for joining us. Um, we've talked about the patients' rights to access their records, and there's some great takeaway tips to help you in your office so you can stay compliant and stay under the radar for any HIPAA complaints or fines. And I'd like to leave our listeners with the important reminder that patients have a right to receive copies of their records in a timely manner. And we must be aware of the fact that the Office of Civil Rights will take appropriate remedial actions if they do not. So follow some of the steps and tips you learned today, and we look forward to seeing you on our next podcast. Any of the resources that we mentioned during this podcast may be found on our website, thecompliancedevas.com. And we invite you to submit any questions to support at thecompliancedevas.com. Thank you for joining us.