A patient records complaint led to a costly HIPAA settlement for a solo dental practice in Pennsylvania.
The Office for Civil Rights (OCR) settled a HIPAA investigation involving Shen Smiles, a Pennsylvania dental practice. The investigation began after a former patient repeatedly requested medical records without receiving them.
During the investigation, the practice reportedly told OCR that a workforce member had taken the records.
However, OCR uncovered additional concerns involving patient privacy, record security, and HIPAA compliance.
OCR Identified Multiple HIPAA Compliance Failures
According to OCR, the practice failed to demonstrate several basic HIPAA safeguards, including:
- Written HIPAA Privacy and Breach Notification policies.
- Documented patient right-of-access procedures.
- Reasonable physical safeguards to protect paper records.
- Formal HIPAA Privacy Rule training for employees.
OCR also identified serious concerns about how the practice stored and transported patient records.
The practice reportedly stored patient records in unsecured boxes throughout the office. Locations included a hygienist’s office, the floor, and a private bathroom.
Staff also transported records between offices and the dentist’s home. In some cases, records were missing when patients arrived for appointments.
These findings demonstrate how poor record management can expose patient information and create significant compliance risks.
Why This Settlement Matters to Small Practices
HIPAA applies to covered healthcare providers regardless of practice size.
Solo practitioners and small dental offices must follow the same applicable HIPAA Privacy and Security Rule requirements as larger organizations.
Practices that use paper records, operate multiple locations, or store records off-site face additional challenges.
Without documented procedures and appropriate safeguards, these practices increase their exposure to complaints, investigations, and potential penalties.
Steps Every Medical and Dental Practice Should Take
Healthcare organizations should review their HIPAA compliance programs and address potential gaps immediately.
- Review HIPAA policies. Maintain written Privacy, Breach Notification, and patient right-of-access procedures.
- Secure patient records. Store paper records in locked areas with appropriate access controls.
- Control record transportation. Establish procedures for moving records between locations and prohibit unauthorized home storage.
- Track record movement. Maintain logs documenting who removes records, their destination, and their return.
- Monitor patient requests. Track access requests and meet HIPAA’s 30-day response deadline, subject to permitted extensions.
- Document employee training. Train workforce members on applicable HIPAA policies and maintain training records.
- Prepare for security incidents. Establish procedures for missing records, suspected theft, breach assessments, workforce sanctions, and required notifications.
- Maintain compliance documentation. Keep policies, training records, and supporting documentation readily available for OCR investigations.
The Bottom Line: Small Practices Are Not Exempt
This settlement did not introduce new HIPAA requirements or include a corrective action plan. The agreement also does not constitute an admission of liability.
However, OCR’s six-figure settlement sends an important message to healthcare providers.
Even a solo dental practice can face significant financial consequences for failing to demonstrate basic HIPAA compliance.
HIPAA compliance requires more than written policies. Practices must implement safeguards, train employees, maintain documentation, and regularly evaluate their compliance programs.
If your practice cannot demonstrate its compliance efforts, an OCR investigation could expose costly gaps.
Protect Your Organization Before It’s Too Late
Aris Medical Solutions helps medical and dental practices identify compliance gaps and implement effective HIPAA safeguards. Our HIPAA Keeper™ compliance system simplifies documentation, risk management, employee training, and ongoing compliance.
Contact Aris Medical Solutions for a complimentary HIPAA compliance consultation.
Schedule your HIPAA compliance review today and protect your organization from the next enforcement headline
Sources