Gums Dental Care: the $70,000 HIPAA penalty for a records request a solo practice left unanswered for three years

What it says#

The HIPAA Privacy Rule's right of access, 45 CFR 164.524, gives a patient the right to inspect and obtain a copy of protected health information in a designated record set for as long as the covered entity keeps it. The covered entity "must act on a request for access no later than 30 days after receipt of the request." If it cannot, it may extend once, by no more than 30 days, provided it tells the patient in writing the reason for the delay and the date it will finish. It must provide the information in the form and format the patient requested if readily producible, otherwise in a readable hard copy or another form the two agree on, and it may charge only a reasonable, cost-based fee covering labor for copying, supplies, postage and any summary the patient agreed to. A personal representative, such as a parent for a minor child, stands in the patient's shoes.

Gums Dental Care, LLC is a solo dental practice in Silver Spring, Maryland, owned and operated by Anna Gumbs, DMD, offering family dental care. On April 8, 2019 a mother asked by email for copies of her records and her three children's; the practice replied the same day with the number of visits each child had made and nothing else. She complained to OCR on May 1, 2019. OCR closed that complaint on May 7 with a technical-assistance letter to the practice explaining 164.524, including the 30-day deadline and the permitted fee, and warning that a similar allegation could lead to a formal investigation. She asked again on June 26, 2019, offering to take the records by email or on paper, filed a second complaint on August 2, and asked a third time on August 26. OCR opened an investigation on September 5, 2019 and sent a data request; the practice did not answer it, or the voicemail on October 8, or the certified copy sent November 7. OCR offered a resolution agreement and corrective action plan on October 1, 2020 and a Letter of Opportunity on December 8, 2020. The practice's written answers said the mother had refused a $25 flat fee to mail the records securely, that the dentist believed she wanted to resubmit claims to a secondary insurer for services Maryland Medicaid had covered, and that the office had no secure website for electronic delivery.

On March 29, 2022 OCR issued a Notice of Proposed Determination. It found a violation of 164.524(b)(2) at the willful-neglect, uncorrected tier running from August 26, 2019, 60 days after the June request, through the date of the notice, 1,028 days. At the 2022 inflation-adjusted minimum of $63,973 per day, capped at $1,919,173 per calendar year, OCR calculated $7,676,692, then proposed $70,000, citing the effect a maximum penalty would have on a solo practitioner's ability to serve its community and the pandemic. On May 17, 2022, seven weeks later, the practice made the records available through Dropbox.

The practice requested a hearing. On September 29, 2023, in Gums Dental Care, LLC, DAB CR6367, the administrative law judge decided the case on the written record, upheld the violation, the tier and the dates, and found $70,000 justified: the practice's two reasons for withholding "are not recognized grounds to deny a request for PHI under 45 C.F.R. § 164.524(a)(2), (3) or recognized affirmative defenses," the $25 mailing offer was "not substantiated by any corroborating evidence," and the practice's own profit and loss statements showed it could pay. The judge counted five people harmed: the mother and three children, who could not seek insurance reimbursement without their records, and the mother's husband, whom the dentist declined to treat because of the complaint. The Departmental Appeals Board affirmed on March 22, 2024 in DAB No. 3132, noting that the practice conceded the records "were not sent within 30 days of the request." OCR announced the penalty on October 17, 2024, calling it its 50th HIPAA Right of Access enforcement action.

Who it applies to#

Any covered entity, and a dental practice that bills electronically is one. The practice here was a single dentist, and the ALJ's decision records that it argued the penalty would force it to close; the answer was that OCR had already cut the calculated amount by more than 90 percent and the financial records showed a profitable business. Size shaped the number, not the outcome.

The right belongs to the patient and to a personal representative, and it covers the designated record set: the chart, the images, the billing records. The rule's exceptions are narrow. Psychotherapy notes and material compiled for litigation are outside the right altogether; a licensed professional's judgment that access is reasonably likely to endanger the patient or another person permits a denial the patient can have reviewed. What the rule does not permit is the thing that happened here: withholding records because of a suspicion about what the patient will do with them, or because the office's email is not secure. The rule tells the office what to do in that second case, which is to produce a readable hard copy or agree on another format.

What changed#

Nothing in the rule; the 30-day clock and the one extension have been in 164.524 since the Privacy Rule of 2000, as amended in 2013. What the case shows is how OCR runs a right-of-access matter against a small practice: a technical-assistance letter first, then an investigation, a proposed settlement, a formal letter inviting mitigating evidence, and only then a proposed penalty, with each unanswered step recorded and later cited as an aggravating factor. The daily-penalty arithmetic is the other lesson. Under 45 CFR 160.406 a continuing violation is a separate violation each day, and at the willful-neglect, uncorrected tier the 2022 minimum was $63,973 a day; a records request that sits for a month at that tier already exceeds the penalty imposed here. The $70,000 was OCR's exercise of discretion, and the ALJ's decision says the practice gave it no reason to exercise more.

Where the source is#

OCR's Notice of Proposed Determination, the ALJ decision (DAB CR6367) and the Board decision (DAB No. 3132) are all on hhs.gov, which refused automated requests from this environment; they were read here through archived captures of those pages, and the dates and amounts above are taken from them. OCR's October 17, 2024 announcement appears in full in the CMS Snapshot for that week, a free PDF on cms.gov. The rule itself, 45 CFR 164.524, and the penalty provisions in 45 CFR 160.404 and 160.408 are on eCFR. All public domain.