The new quartet of enforcement actions by the HHS Office for Civil Rights (OCR) includes two that stem from its Right of Access Initiative, bringing to 27 the number of covered entities (CEs) that have made financial payments and agreed to take corrective actions because they didn’t provide patients their records in an appropriate manner.^[1]

The other two cases both involve dentists—one who used protected health information (PHI) during a political campaign and another who revealed PHI and attacked a patient who posted a bad review online.^[2]

With this large number of settlements ostensibly about the same thing, CEs eyes might be glazing over, with thoughts that there’s not much new to learn from these two recent access cases. Yet, that would be a mistake. While there are some similarities, the case of a dentist in Pennsylvania who successfully fought against a large fine provides a window into how the HIPAA enforcement appeals process works.

Donald Brockley, a dentist in Butler, Pennsylvania, was able to negotiate a significantly reduced penalty after objecting to OCR’s intention to fine him $104,000 for “failure to comply with the right of access provision.”^[3] OCR settled for $30,000, but provided no information about how it came up with, or agreed to, this amount. RPP was unable to reach Brockley for comment.

Most of OCR’s investigations conclude with voluntary settlement agreements and corrective action plans (CAPs). Brockley’s case breaks that mold.