The U.S. Department of Health and Human Services' (HHS) Office for Civil Rights (OCR) has fined Cignet Health of Prince George's County, Md., $4.3 million, in what officials say is the first civil money penalty (CMP) issued for a covered entity's violations of the HIPAA Privacy Rule.

In a Notice of Proposed Determination issued Oct. 20, 2010, OCR found that Cignet violated 41 patients' rights by denying them access to their medical records when requested between September 2008 and October 2009.

According to officials, these patients individually filed complaints with OCR, initiating investigations of each complaint. The HIPAA Privacy Rule requires that a covered entity provide a patient with a copy of their medical records within 30 (and no later than 60) days of the patient's request. The CMP for these violations is $1.3 million.

[See also: Experts guide HIMSS attendees through the privacy maze]

The CMP is based on the violation categories and increased penalty amounts authorized by Section 13410(d) of the Health Information Technology for Economic and Clinical Health (HITECH) Act.

"Covered entities and business associates must uphold their responsibility to provide patients with access to their medical records, and adhere closely to all of HIPAA's requirements," said OCR Director Georgina Verdugo. "The U.S. Department of Health and Human Services will continue to investigate and take action against those organizations that knowingly disregard their obligations under these rules."

[See also:  Report: More than 6M affected since breach notification rule]

During the investigations, Cignet refused to respond to OCR's demands to produce the records, officials said. Cignet also failed to cooperate with OCR's investigations of the complaints and produce the records in response to OCR's subpoena. OCR filed a petition to enforce its subpoena in United States District Court and obtained a default judgment against Cignet on March 30, 2010. On April 7, 2010, Cignet produced the medical records to OCR, but otherwise made no efforts to resolve the complaints through informal means.

OCR also found that Cignet failed to cooperate with OCR's investigations on a continuing daily basis from March 17, 2009, to April 7, 2010, and that the failure to cooperate was due to Cignet's willful neglect to comply with the privacy rule.

"Ensuring that Americans' health information privacy is protected is vital to our health care system and a priority of this administration. The U.S. Department of Health and Human Services is serious about enforcing individual rights guaranteed by the HIPAA Privacy Rule," said HHS Secretary Kathleen Sebelius.