Cignet Health Center (Cignet), a provider of physician, imaging, and laboratory services, was recently ordered to pay $4.3 million as a Civil Money Penalty (CMP) for its failure to comply with the HIPAA privacy rule and its failure to cooperate with the HHS Office of Civil Rights (OCR) in the OCR’s investigation of the underlying HIPAA complaint. This is the first CMP levied by the OCR for a failure to comply with Privacy Rule requirements and reflects an increased focus by OCR on Privacy Rule compliance, an assumption supported by the language of the OCR’s Press Release. Providers can take some solace, however, in the facts that led to the OCR’s imposition of the substantial CMP – Cignet’s seemingly inexplicable failure to cooperate with (or even respond to) the OCR’s repeated requests for information, cooperation, or explanations led to the imposition of such a substantial CMP. So far as can be determined from the public record, Cignet has not told its side of the story.

The final CMP was levied by the OCR in the Final Determination issued to Cignet [PDF] on February 4, 2011. The facts underlying the CMP, however, are described in greater detail in the Proposed Determination [PDF]. In short, Cignet refused to respond to 41 patients’ requests for their own medical records (at least some of whom were reportedly requesting their records to seek care elsewhere). Thirty eight of these refusals to respond resulted in complaints filed with the OCR.