The U.S. Department of Health and Human Services ('HHS') Office for Civil Rights ('OCR') published, on 28 March 2022, its decision in OCR Transaction No. 16-225168, as issued on 1 June 2021, in which it imposed a civil money penalty of $50,000 to Dr. U. Phillip Igbinadolor, D.M.D. & Associates, P.A. ('UPI'), for violations of §164.502(a) of Part 164 of Subchapter C of Subtitle A of Title 45 of the Code of Federal Regulations in accordance with the Health Insurance Portability and Accountability Act of 1996 ('HIPAA'), after impermissibly disclosing the protected health information ('PHI') of an individual.

Background to the decision

In a proposed civil monetary penalty order, the OCR stated that the complainant had visited the company's offices and later posted a negative review online using a pseudonym, after which UPI responded to the review online and impermissibly disclosed the individual's name and PHI. Following this, the individual filed a complaint with the OCR, which reviewed the allegations and requested UPI to disclose to the OCR certain information in the course of this investigation.

Findings of the OCR

Following its investigation, the OCR found that the information impermissibly disclosed by UPI constituted PHI, and as such, the OCR sent UPI a letter for a Notice of Proposed Determination informing UPI of a proposed civil monetary penalty of $50,000. The OCR also detailed in this letter that UPI had a right to request a hearing on the proposed civil monetary penalty within 90 days of receipt of the letter, where no response meant that the penalty could be imposed without a hearing.

Outcomes

The final decision notes that UPI failed to submit a timely request for a hearing in response to the proposed penalty, and as such, has no right of appeal. As a result, the OCR imposed a penalty of $50,000 on UPI for its impermissible disclosure of the PHI of an individual.

You can read the press release here and access the decision here.