Gums Dental Care, LLC, DAB No. 3132 (2024)

FINAL DECISION ON REVIEW OF ADMINISTRATIVE LAW JUDGE DECISION

Gums Dental Care, LLC (Gums Dental) appeals the September 29, 2023 administrative law judge (ALJ) decision captioned as Gums Dental Care, LLC, DAB CR6367 (ALJ Decision).  The ALJ Decision addressed a Notice of Proposed Determination (NPD) by the Director of the Office of Civil Rights (OCR) that found Respondent Gums Dental in violation of 45 C.F.R. § 164.524(b)(2), a regulation implementing the Health Insurance Portability and Accountability Act of 1996 (HIPAA).  OCR’s proposed decision found Gums Dental in violation from August 26, 2019 through March 29, 2022 at the willful neglect level and proposed a civil money penalty (CMP) of $70,000.  The ALJ upheld the cited violation and the $70,000 CMP as justified for Gums Dental’s willful neglect during the specified time period.  The Departmental Appeals Board (Board) affirms the ALJ Decision for the reasons explained below.

Legal Background

The Social Security Act (Act) authorizes the Secretary of Health and Human Services (Secretary) to impose CMPs on violators of certain federal standards applying to health care providers and health information.  Act §§ 1171 (defining “health care provider” and “health information”); 1176 (authorizing penalties).  The Act defines “health care provider” to include “any . . . person furnishing health care services or supplies.”  Act § 1171.  The Act defines “health information” to include “any information” that a health care provider creates or receives that relates to “the provision of health care to an individual” or to an individual’s past, present, or future physical or mental health or condition or payment for health care.  Id.

HIPAA, the Health Information Technology for Economic and Clinical Health (HITECH) Act, and their implementing regulations establish standards relevant to this case.  Pub. L. No. 104-191, 110 Stat. 1936 (1996) (HIPAA); Pub. L. No. 111-5, Title XIII, 123 Stat. 115, 226 et seq. (2009) (HITECH Act); 45 C.F.R. Part 160.  The HIPAA Privacy Rule, 45 C.F.R. Part 160 and Subparts A and E of Part 164, safeguards protected health information (PHI) and “gives individuals rights with respect to their [PHI],

Page 2

including rights to examine and obtain a copy of their health records and to request corrections.”  Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the HITECH Act and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules, 78 Fed. Reg. 5,566, 5,567 (Jan. 25, 2013) (Final Rule).  “The HITECH Act is designed to promote the widespread adoption and interoperability of health information technology,” and in part “supports this goal by adopting amendments designed to strengthen the privacy and security protections for health information established by HIPAA.”  Id. at 5,568.

Under the Privacy Rule, with only limited exceptions, “an individual has a right of access to inspect and obtain a copy of” the individual’s PHI.  45 C.F.R. § 164.524(a).  PHI generally means “individually identifiable health information” that is transmitted by or maintained in electronic media, or is “[t]ransmitted or maintained in any other form or medium.”  45 C.F.R. § 160.103.  Health care providers that are covered entities under the law “must permit an individual to request access to inspect or to obtain a copy of the [PHI] about the individual that is maintained in a designated record set.”  Id. § 164.524(b)(1); see id. § 160.103 (defining “Covered entity”).  The covered entity must respond “no later than 30 days after receipt of the request” by either granting it, denying it, or extending the completion time by at most 30 days with a written statement of the expected completion date and the reasons for the delay.  Id. § 164.524(b)(2).  The covered entity must provide the access that the individual requested, “including inspection or obtaining a copy, or both,” and “in the form and format requested,” including “an electronic copy of such information” if requested and if the PHI is “readily producible in such form and format.”  Id. § 164.524(c)(1), (c)(2)(i)-(ii).  “[T]he covered entity may impose a reasonable, cost-based fee,” which may include only the cost of labor and supplies for copying the PHI, postage when the individual has requested a mailed copy, and preparing any agreed explanation or summary of the PHI.  Id. § 164.524(c)(4).

The Secretary has delegated to the Director of OCR the responsibility for enforcing the Privacy Rule.  OCR; Statement of Delegation of Authority, 65 Fed. Reg. 82,381 (Dec. 28, 2000).  If OCR decides to investigate a covered entity’s compliance, the covered entity must cooperate with OCR by providing records, reports, and access to its premises.  45 C.F.R. § 160.310.  OCR has authority to impose CMPs ranging from $100 to $50,000 per violation for violations occurring on or after February 18, 2009, adjustable annually for violations occurring on or after November 3, 2015.  Act § 1176(a); 45 C.F.R. §§ 102.3, 160.404.  For a continuing violation, “a separate violation occurs each day the covered entity . . . is in violation of the provision.”  45 C.F.R. § 160.406.  The total CMP amount per year is capped “for all such violations of an identical requirement or prohibition during a calendar year” at amounts up to $1,500,000, also adjustable annually.  Act § 1176(a)(3); 45 C.F.R. §§ 102.3, 160.404.

Page 3

Several considerations determine what CMP amount OCR may impose.  Per-violation CMP ranges increase in tiers depending on the covered entity’s degree of knowledge and willfulness in committing the violation.  45 C.F.R. § 160.404(b)(2).  OCR considers listed factors including the nature and extent of the violation and the resulting harm, the violator’s compliance history and financial condition, and “[s]uch other matters as justice may require.”  Id. § 160.408(a)-(e).

OCR must give the alleged violator written notice of OCR’s intent to impose a penalty, in the form of a notice of proposed determination.  45 C.F.R. § 160.420(a).  This notice must include the penalty’s legal and factual basis, its amount, any regulatory factors in section 160.408 considered in determining it, and instructions for responding to it.  Id.

The recipient of such a notice may request a hearing before an ALJ.  45 C.F.R. §§ 160.420(b), 160.504.  On review, an ALJ “may affirm, increase, or reduce the penalties imposed.”  Id. § 160.546(b).  Before the ALJ, the respondent has the burden of going forward and the burden of persuasion with respect to any affirmative defense, any challenge to the proposed penalty amount, and any claim that a proposed penalty should be reduced or waived.  Id. § 160.534(b)(1).  OCR “has the burden of going forward and the burden of persuasion with respect to all other issues,” including any aggravating factors considered in determining the proposed CMP amount.  Id. § 160.534(b)(2).  “The burden of persuasion will be judged by a preponderance of the evidence.”  Id. § 160.534(b)(3).  The ALJ “[m]ay not find invalid or refuse to follow Federal statutes, regulations, or Secretarial delegations of authority and must give deference to published guidance to the extent not inconsistent with statute or regulation.”  Id. § 160.508(c)(1).

A dissatisfied party may request review of the ALJ decision by the Board.  45 C.F.R. § 160.548.  “The Board may decline to review the case, or may affirm, increase, reduce, reverse or remand any penalty determined by the ALJ.”  Id. § 160.548(g).

Case Background ¹

A.     OCR investigation and NPD

Gums Dental is a solo dental practice in Maryland, which Anna Gumbs, D.M.D. (Dr. Gumbs) owns and operates, and the Affected Party (AP) is a patient of Gums Dental.  ALJ Decision at 1-2.  On April 8, 2019, the AP asked Gums Dental for the “specific dates” it had treated the AP’s children.  ALJ Decision at 1 n.1, 5; OCR Ex. 1.  On May 1, 2019, the AP filed a complaint with OCR alleging Gums Dental failed to provide the requested information.  ALJ Decision at 5; OCR Ex. 2.  In a May 7, 2019 technical

Page 4

assistance letter, OCR informed Gums Dental of the AP’s complaint and of Gums Dental’s obligation to comply with 45 C.F.R. § 164.524, including the requirement to act no later than 30 days after receiving a request for access to records.  ALJ Decision at 5; OCR Ex. 3, at 1-3.  OCR closed the case without further action but warned:  “Should OCR receive a similar allegation of noncompliance against Gums Dental Care LLC in the future, OCR may initiate a formal investigation of that matter.”  ALJ Decision at 5; OCR Ex. 3, at 3.

On June 26, 2019, the AP emailed Gums Dental requesting the records of the AP and the AP’s three children.  ALJ Decision at 1 n.1, 6; OCR Ex. 4.  This email included the AP’s mailing address and stated that “emailing would be great as well.”  ALJ Decision at 6, 11; OCR. Ex. 4.

On August 2, 2019, the AP filed a second complaint with OCR alleging that Gums Dental did not provide access to dental records for the AP and the AP’s children despite three requests.  ALJ Decision at 2; OCR Ex. 5.  On August 26, 2019, the AP emailed Gums Dental to ask for the records again, complained of being “left on hold” when calling about them, and added that the “back and forth” was becoming “exhausting.”  OCR Ex. 11, at 7.  Gums Dental did not respond.  ALJ Decision at 6.

A September 5, 2019 data request letter from OCR announced its formal investigation into Gums Dental’s alleged violation of the HIPAA Privacy Rule.  ALJ Decision at 2, 6; OCR Ex. 6.  The letter documented that “OCR contacted the practice and was informed that because it billed [a certain primary payor] for [the AP’s] family treatment, the Complainant was not permitted access to the records because it was under the pretense that she might resubmit the claims to a [different] insurance.” ²  OCR Ex. 6, at 1.  “OCR explained that [the AP] is entitled to copies of her records” nevertheless.  Id.  The letter noted that Gums Dental intended to impose “a flat fee of $25 per record, even when emailed,” which “would need to be paid prior to sending the records.”  Id.  OCR advised Gums Dental that this “allegation could reflect a violation of 45 C.F.R. § 164.524(c) regarding access to medical records” and instructed Gums Dental to answer OCR’s data request.  Id. at 1-4.  OCR also warned that a CMP may be imposed “on an entity for a failure to comply with the HIPAA Rules.”  Id. at 5.  Gums Dental did not respond.  ALJ Decision at 6.

On October 31, 2019, during a follow-up phone call from OCR, Dr. Gumbs said that “she was sick of [the AP] and that she was not going to do anything.”  OCR Ex. 7; see ALJ Decision at 6.  The OCR representative “proceeded to answer that [Dr. Gumbs] was in violation,” but “the Doctor had hung up.”  OCR Ex. 7.

Page 5

In a November 7, 2019 letter to Gums Dental, OCR stated that it had not received a response to its prior data request letter and asked Gums Dental to provide the information within 30 days.³ OCR Ex. 8, at 1-2; see ALJ Decision at 6.  OCR reminded Gums Dental of its “responsibility to cooperate with this investigation” under 45 C.F.R. § 160.310(b).  Id. at 1.  Gums Dental did not respond.  ALJ Decision at 6.

On September 22, 2020, OCR telephoned the AP, who stated that Gums Dental still had not provided the requested records.  OCR Ex. 20.  AP also “indicated that [the AP’s] husband called to schedule an appointment with Dr. Gumbs,” who “would not make the appointment because of the pending case with [the AP].”  Id.; see ALJ Decision at 15.

An October 1, 2020 letter from OCR informed Gums Dental that OCR had investigated the AP’s complaint, and because Gums Dental had not yet responded to the AP’s request for medical records, Gums Dental had violated the Privacy Rule, specifically 45 C.F.R. § 164.524.  ALJ Decision at 6, 13, 15; OCR Ex. 10, at 1.  OCR offered a Resolution Agreement and Corrective Action Plan to resolve the violation and gave Gums Dental 10 calendar days from receipt to respond in writing.⁴  ALJ Decision at 6, 13; OCR Ex. 10, at 1.  Gums Dental did not accept the informal resolution proposed by OCR.  ALJ Decision at 6, 13.  Three weeks later, by letter dated October 22, 2020, Gums Dental replied that the AP “was asked to pay $25.00 to cover the cost of copying the records and having them mailed to her securely” but the AP “refused to pay the $25.00 fee.”  OCR Ex. 11, at 2; see ALJ Decision at 6, 13.  While the letter enclosed several emails from the AP to Gums Dental, none of those emails indicated that Gums Dental had communicated an offer to mail the requested records to the AP upon payment of the fee or that the AP refused to pay it.  See OCR Ex. 11; ALJ Decision at 13, 21 (finding no evidence corroborating the assertion that Gums Dental offered to mail the records to the AP upon payment of the fee).

In a letter to OCR dated November 9, 2020, Gums Dental maintained its position.  OCR Ex. 12.  Gums Dental stated that the information the AP had requested “should not be used to file any claim forms” and that the AP owed “a $25 administrative fee [that] is required to forward all of the records to [the AP] securely.”  Id.; see ALJ Decision at 6, 13.

In a December 8, 2020 letter, OCR documented Gums Dental’s decision not to engage in settlement negotiations and informed Gums Dental of a preliminary indication of

Page 6

noncompliance.  ALJ Decision at 6, 14; OCR Ex. 13, at 1.  OCR invited Gums Dental to submit, within 30 calendar days, written evidence of any mitigating factors under 45 C.F.R. § 160.408 or affirmative defenses under section 160.410 for OCR’s consideration in determining a CMP, or written evidence supporting waiver of a CMP.  ALJ Decision at 7, 14-15; OCR Ex. 13, at 1-2.

Responding by letter to OCR dated January 4, 2021, Gums Dental again refused to give the AP “any information to fill out an [additional] insurance form,” and “did not agree with” OCR’s directive to release the records regardless of what the AP chose to do with them.  OCR Ex. 16, at 1; see ALJ Decision at 7, 14.  Gums Dental also resisted emailing the records as the AP requested, noting that Gums Dental “does not have a secure website where patients can access their records securely,” and insisted the AP could retrieve them “from the office or pay Twenty Five Dollars to have them mailed to her.”  OCR Ex. 16, at 2; see ALJ Decision at 7.  Although Gums Dental indicated its discomfort with emailing the records, ALJ Decision at 3, 14, it did not argue or present any evidence that the records were not readily producible by email.  Dr. Gumbs emphasized that she refused to be “bullied,” adding that, “even though I cannot quote all the HIPAA rules, I know when something is not on the up and up.”  OCR Ex. 16, at 2.

A July 6, 2021 memorandum documented the AP’s report that, “due to her filing of the complaint with OCR,” Gums Dental had refused an appointment to the AP’s spouse.⁵  OCR Ex. 21; see ALJ Decision at 15.  The AP also reportedly “did not attempt to schedule any appointments for herself or the children because she is still searching for a provider” other than Gums Dental after almost a year.  OCR Ex. 21.  The AP also said Gums Dental still refused to provide the requested records due to the AP’s insurance status.  Id.

On completing its investigation, OCR issued the March 29, 2022 NPD, which notified Gums Dental of a proposed $70,000 CMP under the HIPAA and HITECH laws.  ALJ Decision at 2; NPD at 1-2.⁶  The NPD summarized the basis for the CMP:  “Gums Dental failed to provide access to medical records in violation of 45 C.F.R. § 164.524(b)(2) after lawful requests for such records from its patient and repeated explanations of Gums Dental’s obligations to provide such records by OCR.”  NPD at 6-7.  The NPD itemized 29 supportive Findings of Fact.  Id. at 2-6.  The cited violation spanned from August 26, 2019 to March 29, 2022 at the penalty tier of “willful neglect, uncorrected,” with a stated maximum potential penalty of $1,919,173 for each year from 2019 through 2022, inclusive.  Id. at 7.  The NPD stated that Gums Dental had an opportunity but did not

Page 7

submit any evidence of affirmative defenses, mitigating factors, or reasons to grant a waiver of the CMP.  Id. at 6-7.  OCR stated how it considered each section 160.408 factor to establish the CMP, and found “no basis for waiver of the proposed CMP amount” per section 160.412.  Id. at 7-8.  OCR determined that it could impose a CMP on Gums Dental totaling $7,676,692 but, based on the regulatory factors, “determined that a CMP of $70,000 is warranted in this matter.”  Id. at 9.  The NPD closed by informing Gums Dental of its right to a hearing and how to request one.  Id. at 9-10.

B.     Gums Dental’s Request for Hearing and ALJ Proceedings

On May 31, 2022, Gums Dental, through newly retained legal counsel, requested an ALJ hearing to contest the NPD.⁷ Request for Hearing (RFH) at 1-4.  Gums Dental denied most of the NPD’s factual findings, but admitted it is a solo practice providing family dental care, creates and maintains PHI related to its patients, and is a “covered entity” under 45 C.F.R. § 160.103 that must comply with the Privacy Rule.  RFH at 1-2, ¶¶ 1-3; NPD at 2-3, ¶¶ 1-3.  Gums Dental also admitted that OCR’s September 5, 2019 letter requested data (including whether the AP had received the requested records), and advised of OCR’s authority to collect such information, yet Gums Dental did not respond even after a follow-up voice mail and telephone call from OCR.  RFH at 2, ¶¶ 10-13; NPD at 3-4, ¶¶ 10-13; Gums Dental’s Pre-Hr’g Exchange and Opp. to Mot. for Summ. J. at 3.  Gums Dental allegedly withheld the records from the AP for various reasons, including that Dr. Gumbs unsuccessfully “attempted to communicate regarding the best way to transmit” them, did “not feel comfortable emailing” them, and needed consent from the AP’s “children who had reached the age of majority.”  RFH at 2-3, ¶¶ 8-9, 27.  Gums Dental claimed it did not answer OCR’s data request because Dr. Gumbs “was in the midst of moving her practice and finding legal representation” and did not understand “her legal rights.”  Id. at 2, ¶ 12.

After discovery,⁸ OCR filed a pre-hearing exchange and motion for summary judgment along with 21 exhibits.  OCR’s Pre-Hr’g Exch. and Mot. for Summ. J.; OCR’s Proposed Ex. List; OCR Exs. 1-21.  OCR argued that the “undisputed, material facts demonstrate that Gums Dental failed to respond to [the AP’s] request for PHI in violation of 45 C.F.R. § 164.524(b)(2) at the willful neglect level,” and OCR appropriately considered the

Page 8

section 160.408 factors and reduced the proposed CMP “significantly” from over $7,000,000 to $70,000.  OCR’s Pre-Hr’g Exch. and Mot. for Summ. J. at 17.

Gums Dental then filed its own pre-hearing exchange and opposed summary judgment. ⁹  Gums Dental’s Pre-Hr’g Exchange and Opp’n to Mot. for Summ. J.  Gums Dental admitted it is “an entity that is required to comply with the Privacy Rule, including the right of access provisions.”  Id. at 6.  However, Gums Dental argued, a health care professional may determine “in the exercise of professional judgment” that providing records “is reasonably likely to cause substantial harm,” and Gums Dental “had a legitimate belief” that the AP was requesting health care records for “committing insurance fraud.”  Id. at 6-7 (quoting 45 C.F.R. § 165.524(a)(3)(iii)).  Gums Dental also claimed it unsuccessfully tried to supply the records to the AP for pick-up at the office or by mail, and ultimately made them available to the AP “via secure Drop Box link on May 17, 2022.”  Id. at 4, 7; see OCR Ex. 19 (Dropbox Page).  Gums Dental argued innocence of “willful neglect” under section 160.404(b)(2) for various reasons, including a belief that the case was closed, harassing emails from the AP, and concerns about insurance fraud.  Gums Dental’s Pre-Hr’g Exchange and Opp’n to Mot. for Summ. J.at 7-8.  Finally, Gums Dental argued the proposed CMP was excessive because the AP and the AP’s children suffered no “actual harm” or hindrance to their “ability to obtain health care,” this is Gums Dental’s “first and only investigation” by OCR, and the penalty would force Dr. Gums “into retirement.”  Id. at 8-11 (discussing 45 C.F.R. § 160.408(a)-(d)).

OCR argued three main points in reply.  First, “the Privacy Rule does not allow a covered entity to deny a right of access request based on a belief regarding how the information will be used,” and 45 C.F.R. § 164.524(a)(3)(iii) “is not applicable.”  OCR Reply at 2.  Second, Gums Dental’s newly provided financial information, which it did not give to OCR during its investigation, did not change the appropriateness of the $70,000 CMP.  Id. at 4-7.  Third, “[w]hether the covered entity acted with reasonable cause or willful neglect goes to the amount of the CMP and not whether OCR is allowed to issue a CMP,” and any contrary argument by Gums Dental “misstates the law.”  Id. at 7 (citing 45 C.F.R. § 160.404(b)(2)).  OCR concluded that “Gums Dental has not made any legitimate arguments or provided any evidence to dispute” its violation of section 164.524(b)(2) at the willful neglect level, and the $70,000 CMP was appropriately determined.  Id. at 7-8.

Page 9

C.     The ALJ Decision

The ALJ deemed an in-person hearing unnecessary and decided the case in OCR’s favor on the written record rather than by summary judgment.  ALJ Decision at 5 & n.6.  The ALJ admitted into evidence all of OCR’s exhibits and Gums Dental’s Exhibit 11.  Id. at 4.  The ALJ ruled that Gums Dental violated 45 C.F.R. § 164.524(b)(2) at the willful neglect level from August 26, 2019 through March 29, 2022 and that a CMP of $70,000 is justified based on evaluation of the factors listed in section 160.408.  Id. at 2.

The ALJ made extensive factual findings concerning the AP’s repeated records requests to Gums Dental and OCR’s resulting investigation.  ALJ Decision at 5-7.  The ALJ found Gums Dental was “a ‘covered entity’ as defined by 45 C.F.R. § 160.103,” and thus “45 C.F.R. § 164.524(b)(2)(i) required [Gums Dental] to act on a request for access no later than 30 days after receipt of the request.”  Id. at 7.  The ALJ found that the AP “requested a copy of her and her children’s records on June 26, 2019,” which Gums Dental “did not provide . . . until May 17, 2022, when it made the records available via Dropbox.”  Id.

The ALJ then reached legal conclusions that the Privacy Rule requires covered entities to give individuals access to their PHI on request, and that Gums Dental violated 45 C.F.R. § 164.524(b)(2) by not taking timely action on the AP’s request for the PHI of the AP and the AP’s children.  Id. at 7-12.  The ALJ ruled it “undisputed that [Gums Dental] did not provide the requested documents or a written denial to the AP within 30 days,” and that Gums Dental admittedly “did not provide the AP with the requested treatment records until May 17, 2022,” nearly three years later.  Id. at 10-12.

The ALJ next concluded that Gums Dental’s violation of 45 C.F.R. § 164.524(b)(2) occurred from August 26, 2019 through March 29, 2022 at the willful neglect tier.  Id. at 12-16.  After citing the regulatory definition of “willful neglect,” in section 160.401, the ALJ ruled that the “facts and circumstances in the record establish willful neglect.”  Id. at 12.  Regarding the violation’s start date of August 26, 2019, the ALJ noted the AP had unsuccessfully requested “copies of her and her three children’s treatment records on June 26, 2019,” then filed a second HIPAA complaint, then “renewed her request for the treatment records by email on August 26, 2019.”  Id. at 12-13 n.12.  The ALJ reasoned that Gums Dental failed to provide the AP with access to the records “over a protracted period of time,” despite receiving OCR’s May 7, 2019 technical assistance letter and multiple requests from the AP.  Id. at 12-13.  The ALJ determined that Gums Dental also initially did not cooperate with OCR’s investigation as section 160.310(b) required, after receiving OCR’s September 5, 2019 data request letter and follow-up communications.  Id. at 13.  Furthermore, the ALJ determined that Gums Dental, through Dr. Gumbs, “actively refused to provide the requested records” and “continued to argue impermissible grounds for refusing to provide the AP with” them, “in violation of 45 C.F.R. § 164.524(b)(2).”  Id. at 13-14.  The ALJ again emphasized that Gums Dental “refused to provide access to the AP’s and her children’s PHI until nearly two months

Page 10

after receiving OCR’s NPD, which was nearly three years after the AP’s first request for the records.”  Id. at 15.  OCR issued the NPD, the ALJ observed, only “[a]fter several attempts over fifteen months to resolve the violation and/or to negotiate a reduced CMP” with Gums Dental.  Id.  The ALJ therefore rejected Gums Dental’s claims of reasonable cause or reasonable diligence, and instead concluded this case was one of willful neglect.  Id. at 16.

Finally, the ALJ ruled that a $70,000 CMP is justified.  Id. at 16-22.  After reviewing evidence relevant to the 45 C.F.R. § 160.408(a)-(c) factors (addressing the violation’s nature and extent, the resulting harm, and Gums Dental’s compliance history), the ALJ agreed with OCR that those factors “are aggravating here, not mitigating.”  Id. at 17-19.  The ALJ determined that Gums Dental’s violation harmed “[f]ive individuals,” meaning the AP and the AP’s family, the “violation persisted for a lengthy period of time,” and Gums Dental was repeatedly unresponsive or resistant to OCR’s communications.  Id. at 19.  After reviewing the evidence relevant to section 160.408(d) (concerning the covered entity’s financial condition), the ALJ observed that OCR had reduced the penalty “over 90 percent,” to $70,000, and found that Gums Dental’s evidence did “not support a further reduction.”  Id. at 19-21.  The ALJ held that Gums Dental’s reasons for not giving the AP the requested records “are not recognized grounds to deny a request for PHI under 45 C.F.R. § 164.524(a)(2), (3) or recognized affirmative defenses under 45 C.F.R. § 160.410.”  Id. at 21.  Finally, the ALJ concluded Gums Dental was ineligible for waiver of the CMP under 45 C.F.R. § 160.412.  Id. at 22.

Standard of Review

The standard of review on a disputed issue of fact is whether the ALJ’s decision is supported by substantial evidence on the whole record, and the standard of review on a disputed issue of law is whether the ALJ decision is erroneous.  45 C.F.R. § 160.548(h); accord Guidelines – Appellate Review of Decisions of Administrative Law Judges Relating to Imposition of Civil Money Penalties Based on Violations of the HIPAA Administrative Simplification Provisions (Guidelines), “Completion of the Review Process,” ¶ (c), (last visited Mar. 18, 2024),  
https://www.hhs.gov/about/agencies/dab/different-appeals-at-dab/appeals-to-board/guidelines/civil-money/index.html?language=en).

Analysis

After receiving an extension of time, Gums Dental filed an appeal and nine attachments with the Board.  Request for Review (RR); Atts. 1-9.  Gums Dental advises that “Dr. Gumbs will serve as representation for herself and Gums Dental” because “she and the practice are no longer represented by the attorney previously assigned.”  RR at 1.  Procedurally, Gums Dental complains that its “request for a trial was presented from the onset of this case, but was not granted.”  Id. at 7.  On the primary issue of compliance

Page 11

with 45 C.F.R. § 164.524(b)(2), Gums Dental admits that the AP “was not given the records when she initially requested them” and “that the records were not sent within 30 days of the request,” but alleges extenuating circumstances.  Id. at 2, 4.  Regarding the level of noncompliance, Gums Dental contends that it “did not willfully neglect to send” requested records for one of the AP’s children, and that it is “not guilty of willful neglect” generally.  Id. at 4, 7.  Gums Dental then raises several challenges to the appropriateness of the $70,000 CMP, which we analyze below.  Id. at 4-6.

OCR counters that Gums Dental provides “no new evidence or new legal support to meaningfully challenge” the ALJ Decision and repeats arguments that are not legitimate defenses.  OCR’s Br. in Resp. to Pet’r’s RR at 1.  OCR argues it is undisputed that Gums Dental violated 45 C.F.R. § 164.524(b) by admittedly not sending the records within 30 days of the AP’s request and not sending a written denial.  Id. at 10.  OCR claims Gums Dental offers legally unsupported “excuses” that the Privacy Rule “does not allow.”  Id. at 11-12 (citing section 164.524(a)(2)-(3)).  OCR argues the ALJ’s conclusion of willful neglect was not erroneous, Gums Dental does not meaningfully challenge it, and “substantial evidence on the whole record” shows Gums Dental’s “conscious, intentional failure, or reckless indifference to its obligations to comply with the Privacy Rule . . . for years.”  Id. at 13-15.  Finally, OCR contends that substantial record evidence also supports the ALJ’s factual findings concerning the CMP amount.  Id. at 15-21.

Gums Dental replies with five additional attachments and renews its request for “a hearing . . . in front of the judge.”  Reply at 2; Atts. A-E.  Regarding the ALJ’s determination of noncompliance with 45 C.F.R. § 164.524(b), Gums Dental concedes it “is unable to cite specific legal codes” and is “short on evidence,” but again expresses concerns with the AP’s “other insurance” and with “sending the records securely.”  Id. at 1-2.  Gums Dental denies willful neglect.  Id.  Regarding the CMP amount, Gums Dental acknowledges that the AP’s “record request was not fulfilled within 30 days,” but maintains that the $70,000 CMP “is unjustifiable.”  Id. at 2.  In closing, Gums Dental asks for a particular OCR attorney to be “investigated for her role in allowing this matter to escalate as far as it has” and for “a thorough review of the arguments and evidence presented in this case in hopes of leniency regarding the decision.”  Id. at 3.

For the reasons explained below, we reject Gums Dental’s arguments and affirm the ALJ Decision.  The ALJ did not err by deciding the case on the written record without an in-person hearing.  Gums Dental has proffered additional evidence on appeal, but without establishing its relevance and materiality or showing reasonable grounds for not presenting it to the ALJ. We see no error in the ALJ’s determinations that Gums Dental violated 45 C.F.R. §164.524(b)(2) by not providing the requested records or a written denial within 30 days of the AP’s request, and that this violation occurred at the willful neglect tier from August 26, 2019 through March 29, 2022.  Further, the ALJ did not err in upholding the $70,000 CMP based on the section 160.408 factors.  Finally, the ALJ and the Board may not consider Gums Dental’s requests for equitable relief.

Page 12

1. The ALJ did not err by deciding this case without conducting an in-person hearing, and Gums Dental is not entitled to present testimony or oral argument before the Board.

Gums Dental desires an in-person hearing, and objects to not receiving one sooner.  See RR at 5 (“From the very beginning, Gums Dental Care asked to take the matter before the judge. . . .”); id. at 6-7 (“Gums Dental Care is requesting to have a trial in front of a judge with Dr. Gumbs and [the AP] present.”); Reply at 2 (“From the onset of this case, Gums Dental Care, LLC requested to go before the judge in person,” and “I, Anna Gumbs, once again request a hearing to have my case heard in front of the judge so that the record can be set straight.”).  For reasons discussed below, the ALJ did not err in deciding the case on the written record without an in-person hearing, and Gums Dental is not entitled to present testimony or oral argument before the Board.

To the extent Gums Dental contends the ALJ should have held an in-person hearing, we affirm the ALJ’s determination that no such hearing was necessary.  An ALJ must let the parties cross-examine witnesses “as may be required for a full and true disclosure of the facts.”  45 C.F.R. § 160.538(d).  “Where no witness testimony is proffered,” however, “or all witness testimony is submitted in writing and no cross-examination is sought, there is no need to convene an in-person hearing.”  Five Star Healthcare, LLC, DAB No. 3089, at 8 (2023).  Accordingly, the ALJ told the parties from the outset that “[a]n in-person hearing will be necessary only if a party files admissible, written direct testimony, and the opposing party asks to cross-examine the witness(es).”  Standing Pre-Hr’g Order of ALJ Leslie C. Rogall for Cases Involving OCR (Pre-Hr’g Order) at 7, ¶ 10.  When deciding this case, the ALJ accurately summarized that “[n]either pre-hearing exchange included any written direct testimony or proposed witnesses,” and correctly concluded that, “[a]s a result, an in-person hearing is unnecessary.”  ALJ Decision at 5 (quoting Pre-Hr’g Order at 7, ¶¶ 9-10).  In other words, “[b]ecause no written direct testimony was filed, neither party requested cross-examination,” and “[b]ecause cross-examination was not requested, no in-person hearing was held,” and “[w]e find no error in this result.”  Ilya Kogan, DAB No. 3034, at 4 (2021), aff’d, Civ. No. 21-10856, 2023 WL 8253074 (D.N.J. Nov. 29, 2023); see also James Brian Joyner, M.D., DAB No. 2902, at 12 (2018) (finding “no error in the ALJ’s issuance of a decision based on the written record without holding an in-person hearing after the ALJ provided clear notice that he would do so if a hearing is not necessary . . . because neither [party] offered any written direct testimony”).  Accordingly, Gums Dental was not entitled to an in-person hearing and the ALJ did not err by not holding one.

To the extent Gums Dental is asking to present evidence or oral argument in person before the Board, we deny that request.  The Board’s role here is to review the administrative record for factual or legal error, not to hold a trial featuring witness testimony.  45 C.F.R. § 160.548(h).  “On rare occasions, the Board may grant a request for oral argument if the Board determines that oral argument would facilitate its decision-

Page 13

making,” and a party desiring oral argument “should state the purpose of the requested appearance.”  Guidelines, “Development of the Record on Appeal,” ¶ (e).  Gums Dental has not stated any valid purpose for oral argument, and this factually and legally straightforward case is ripe for decision on the parties’ briefs and the record alone.  Therefore, we hold, as we have held in comparable cases, that oral argument is unnecessary.  See Copperas Cove LTC Partners, Inc., DAB No. 3049, at 7 n.4 (2021) (denying oral argument in case involving CMP because parties’ positions were “adequately explained in their appeal briefs” and Board could “make a sound decision based on those submissions and the record developed before the ALJ”); Douglas Bradley, M.D., DAB No. 2663, at 4 n.4 (2015) (denying oral argument, in case involving revocation of Medicare billing privileges, because “the issues have been adequately presented by the parties in their written materials” such that “oral argument would not help our decision-making”); Highland Pines Nursing Home, Ltd., DAB No. 2361, at 1 n.1 (2011) (denying oral argument in case involving CMP imposed on long-term care facility because it “stated no purpose for the request as required by Board Guidelines”).

2. Gums Dental’s newly submitted evidence establishes no basis for a remand to the ALJ for consideration of additional evidence.

If Gums Dental “demonstrates to the satisfaction of the Board that additional evidence not presented at [the ALJ] hearing is relevant and material and that there were reasonable grounds for the failure to adduce such evidence at the hearing, the Board may remand the matter to the ALJ for consideration of such additional evidence.”  45 C.F.R. § 160.548(f).

Before the Board, Gums Dental proffers additional evidence (Attachments 1-9 to its request for review and Attachments A-E to its reply brief), but without making the requisite showing to warrant a remand.  Many of these documents duplicate exhibits already in the record, and the non-duplicative evidence Gums Dental proffers is either irrelevant and immaterial, submitted untimely without reasonable grounds, or both.

A.     Duplicative evidence

Several of Gums Dental’s new documents (Attachments 1-3, 9, A, and B) duplicate evidence that the ALJ already admitted and reviewed.  Specifically:  Attachments 1 and B duplicate OCR Ex. 1; Attachment 2 duplicates OCR Ex. 11, at 4; Attachments 3 and A duplicate OCR Ex. 21; and Attachment 9 duplicates OCR Ex. 16.  Therefore, those attachments are not new evidence and cannot warrant a remand to the ALJ.

B.     Irrelevant and immaterial evidence

Attachment 8 and portions of Attachment E relate to Gums Dental’s treatment of the AP’s spouse in October 2023, after issuance of the ALJ Decision, so Gums Dental could

Page 14

not have presented this evidence to the ALJ; however, it is irrelevant and immaterial.¹⁰   Gums Dental now denies that it refused to treat the AP’s spouse, RR at 5, but did not contest that issue before the ALJ and therefore cannot raise it here.  See 45 C.F.R. § 160.548(e) (stating that, except for certain inapplicable affirmative defenses, “the Board may not consider any issue not raised in the parties’ briefs, nor any issue in the briefs that could have been raised before the ALJ but was not.”).  Also, October 2023 treatment information for the AP’s spouse is not relevant and material because Gums Dental’s alleged noncompliance during the earlier time period of August 26, 2019 through March 29, 2022 is at issue.  OCR factored Gums Dental’s reported refusal to treat the AP’s spouse into the CMP amount determination.  NPD at 7, ¶ 1.  Evidence that Gums Dental may have been willing to treat the AP’s spouse in October 2023, after OCR already had issued the NPD, is irrelevant and immaterial.  See William Frank Elder-Quintana, DAB No. 3082, at 13 (2023) (declining to remand case for ALJ to consider new evidence, as petitioner “failed to demonstrate that the additional evidence is relevant and material” to applicable regulatory provisions).

C.     Evidence that is presented untimely without reasonable grounds

Gums Dental’s remaining new documents (Attachments 4-7, Attachments C-D, and the portions of Attachment E not already addressed above) predate the ALJ Decision, and Gums Dental states no reason for not producing them before the ALJ, so they do not merit further review on that basis alone.  See 45 C.F.R. § 160.548(f); Elder-Quintana at 12  (rejecting new evidence where petitioner had not “demonstrated reasonable grounds for not presenting the evidence to the ALJ” such as claiming “that the evidence was unavailable, or could not have been obtained with reasonable effort, when the ALJ case was pending”); see also Gracia L. Mayard, M.D., DAB No. 2767, at 7 (2017) (rejecting new evidence where petitioner did “not allege any grounds, much less ‘reasonable’ ones, for his failure to submit these materials to the ALJ”).

Much if not all of this newly submitted documentation is irrelevant and immaterial as well, for it does not tend to show that Gums Dental timely provided the requested records or a written denial, acted without willful neglect, or is entitled to a CMP less than $70,000.  For example, Attachment 7 contains miscellaneous registration information for the AP, and Attachment C is page 34 of an unidentified document concerning “Claim Submission Procedures.”  (Emphasis omitted).  Even if any of this proposed evidence had any relevance or materiality, Gums Dental has presented no reason for not timely presenting it to the ALJ to consider.  It provides no basis for a remand.

Page 15

3. The ALJ’s conclusion that Gums Dental violated 45 C.F.R. § 164.524(b)(2) by not taking timely action on the AP’s PHI request is supported by substantial evidence and free of legal error.

Gums Dental does not dispute the factual findings or legal authorities from which the ALJ determined that Gums Dental violated 45 C.F.R. § 164.524(b)(2); therefore, we summarily affirm the ALJ decision in that respect.  See Phoenix Healthcare, LLC, DAB No. 3105, at 8 (2023) (summarily upholding ALJ’s determination, where a party did “not dispute the ALJ’s factual findings and has not appealed the ALJ’s conclusions that it violated 45 C.F.R. § 164.524(b)(2)”).  Gums Dental “agrees that [the AP] was not given the records when she initially requested them,” RR at 2, “admit[s] that the records were not sent within 30 days of the request,” id. at 4, and acknowledges that the AP’s “records request was not fulfilled within 30 days,” Reply at 2.  “It is also undisputed,” as the ALJ observed, that Gums Dental “did not provide . . . a written denial to the AP within 30 days of receiving her request.”  ALJ Decision at 10.  Gums Dental also admits that it is a covered entity required to comply with the Privacy Rule, including its right of access provisions.  See NPD at 2-3, ¶ 1; RFH at 1, ¶ 1; Gums Dental’s Pre-Hr’g Exchange and Opp. to Mot. for Summ. J. at 6.  “Failure to articulate at least some disagreement with the basis for an ALJ’s decision of an issue permits the Board to summarily affirm the ALJ’s findings of fact and conclusions of law on that issue.”  Duke Ahn, M.D., DAB No. 3093, at 14 (2023).  We thus affirm that Gums Dental violated section 164.524(b)(2).

While Gums Dental admits it did not provide the records that the AP requested (or a written denial) for more than 30 days, it attempts various justifications for withholding the records.  Gums Dental alleges that “[the AP’s] request was not a standard request for health records,” because the AP “specifically asked for records to fill out an [additional] dental claim,” which purportedly had ramifications for Gums Dental’s reimbursement rate, reputation, and anti-fraud interests.  Reply at 2; see RR at 2-4 (arguing that Gums Dental “was not going to allow [the AP] to file [additional] dental claims,” that “fraudsters can hide behind” OCR, and that Gums Dental “cannot afford to get a reputation . . . of being an easy target for unsavory behavior”).  Gums Dental also argues that the AP “was not an active patient” and could have called the primary insurer’s office for information instead.  RR at 2.  Gums Dental claims uncertainty about the AP’s mailing address, and that the AP refused to pick up the records in person.  Id. at 3-4; Reply at 2 (“The concern was with sending the records securely” as Gums Dental “sent a letter to the patient via certified mail that she did not respond to.”).  Gums Dental now claims that the $25 fee it required before releasing the records “was never a big issue.”  RR at 4.  Gums Dental also claims that its office temporarily closed due to the COVID-19 pandemic and one of the AP’s family members already was an adult.  RR at 4.

Gums Dental not only failed to issue a written denial in accordance with 45 C.F.R. § 164.524(b)(2)(i)(B), but also asserts rationales for withholding the requested records that are not authorized grounds for a denial under section 164.524(a)(2)-(3).  For

Page 16

example, Gums Dental does not contend that the requested records were psychotherapy notes, involved treatment of a correctional inmate or ongoing research, or contained information that was reasonably likely to endanger any individual’s life or physical safety.  See 45 C.F.R. § 164.524(a)(1)(i), (a)(2)(i)-(iii), (a)(3)(i).  Gums Dental baselessly resisted emailing the records as the AP asked, for “covered entities are permitted to send individuals unencrypted emails if they have advised the individual of the risk, and the individual still prefers the unencrypted email.”  See 78 Fed. Reg. at 5,634.  Gums Dental’s excuse that it does not have a secure website would not have prevented it from sending the records by email (encrypted or not) as the AP had requested.  The AP requested the documents electronically, so “a $25.00 administrative flat fee to mail the records via certified mail using the United States Postal Service would not be permissible for providing access under the Privacy Rule.”  NPD at 5, ¶ 23.  Yet Gums Dental’s refusal to release the records unless the AP paid a $25 administrative fee is well documented in the record.  See OCR Ex. 11, at 2 (letter from Gums Dental to OCR confirming “$25.00 fee so that the dental records requested can be copied and mailed securely,” which the AP allegedly “refused to pay”); OCR Ex. 12 (confirmation by Dr. Gumbs to OCR that “a $25 administrative fee is required to forward all of the records to [the AP] securely, which remains unpaid, to date”).  The AP’s request to email the documents also negates Gums Dental’s argument that it was willing to send the documents by UPS or FedEx but first needed “to verify that the address [the AP] gave previously was still correct.”  See RR at 3.  Gums Dental was obligated to comply with section 165.524(c)(1)-(2), that is, to “provide the access” the AP requested “to the [PHI] in the form and format requested by” the AP.

Therefore, the ALJ’s conclusion that Gums Dental violated 45 C.F.R. § 164.524(b)(2) by failing to take timely action on the AP’s PHI request is free of factual and legal error.

4. The ALJ’s conclusion that Gums Dental violated 45 C.F.R. § 164.524(b)(2) from August 26, 2019 through March 29, 2022 at the level of willful neglect is supported by substantial evidence and free of legal error.

“We are not guilty of willful neglect,” Gums Dental asserts, but without any supporting argument addressing the governing legal standard.  RR at 7.  The Privacy Rule sets out increasing culpability levels for violations.  The lowest level is for violators who “did not know and, by exercising reasonable diligence, would not have known” of the violation.  45 C.F.R. § 160.404(b)(2)(i).  “Reasonable diligence means the business care and prudence expected from a person seeking to satisfy a legal requirement under similar circumstances.”  Id. § 160.401.  The intermediate level is for violations “due to reasonable cause and not to willful neglect.”  Id. § 160.404(b)(2)(ii).  “Reasonable cause” means the covered entity “knew, or by exercising reasonable diligence would have known,” it was in violation but “did not act with willful neglect.”  Id. § 160.401.  The highest level of culpability is for violations “due to willful neglect,” with two sublevels:  those corrected, and those not corrected, “during the 30-day period beginning on the first

Page 17

date” the violator “knew, or, by exercising reasonable diligence, would have known that the violation occurred.”   Id. § 160.404(b)(2)(iii)-(iv).  “Willful neglect means conscious, intentional failure or reckless indifference to the obligation to comply with the . . . provision violated.”  Id. § 160.401.

We perceive no error in the ALJ’s determination that the “facts and circumstances in the record establish willful neglect.”  ALJ Decision at 12.  The ALJ reasonably relied on evidence of Gums Dental’s deliberate refusal of the AP’s “multiple requests” for records access, “over a protracted period of time” (spanning at least from August 26, 2019, through OCR’s March 29, 2022 NPD), despite OCR’s repeated communications informing Gums Dental of the requirement to comply.  Id. at 12-16; see OCR Ex. 1 (original April 8, 2019 information request from the AP to Gums Dental); OCR Ex. 3 (May 7, 2019 OCR technical assistance letter to Gums Dental); OCR Ex. 4 (June 26, 2019 email from the AP to Gums Dental requesting records); OCR Ex. 11, at 7 (August 26, 2019 follow-up email by the AP to Gums Dental requesting records); OCR Ex. 6, at 1-2, 5 (September 5, 2019, OCR letter informing Gums Dental of its investigation, requesting data, and stating that the AP “is entitled to copies of her records” and “OCR may impose a CMP on an entity for a failure to comply with the HIPAA Rules”); OCR Ex. 8, at 1 (November 7, 2019 OCR letter reminding Gums Dental that it had not yet responded to OCR’s data request and asking for response within 30 days); OCR Ex. 10, at 1 (October 1, 2020 OCR letter advising Gums Dental it still had not responded to the AP’s record requests and had violated section 164.524, and offering a Resolution Agreement and Corrective Action Plan); OCR Ex. 11, at 2 (October 22, 2020 letter from Gums Dental conditioning the AP’s access to the requested records on receipt of $25 fee); OCR Ex. 12 (November 9, 2020 Gums Dental letter repeating requirement that the AP pay a $25 fee to obtain the records); OCR Ex. 13, at 1 (December 8, 2020 OCR letter informing Gums Dental of preliminary indication of noncompliance); OCR Ex. 16, at 1 (January 4, 2021 letter from Gums Dental to OCR stating Gums Dental “will not give [the AP] any information to fill out an [additional] insurance form,” and “did not agree” with OCR’s direction to provide the records).  Thus, the ALJ supportably concluded from the record evidence that Gums Dental “demonstrated a conscious, intentional failure, or reckless indifference to its obligation to comply” with applicable law.  ALJ Decision at 15.

Gums Dental does not establish any error in the ALJ’s conclusion that Gums Dental’s violation occurred at the level of uncorrected willful neglect.  Gums Dental does not persuasively show any lesser culpability level, despite claiming that it “cooperated with the investigation to the best of its ability.”  Reply at 2; see also RR at 6 (“To say Gums Dental Care did not cooperate is incorrect.”).  There is no error where, as here, “[t]he record does not show either that [the covered entity] ‘did not know’ and, ‘by exercising reasonable diligence, would not have known’ that it violated the Privacy Rule . . . or that the violations were ‘due to reasonable cause and not to willful neglect.’”  Phoenix at 14 (citing 42 U.S.C. § 1320d‑5(a)(1) and 45 C.F.R. § 160.404(b)(2)).  As highlighted above,

Page 18

the record demonstrates that OCR repeatedly informed Gums Dental of its Privacy Rule obligations, and Gums Dental’s noncompliance was “conscious” and “intentional,” or at the very least showed “reckless indifference.”  See 45 C.F.R. § 160.401 (defining “Willful neglect”); see also, e.g., OCR Ex. 7 (OCR record of October 31, 2019 telephone call during which Dr. Gumbs “said that she was sick of [the AP] and that she was not going to do anything” and “hung up” on OCR’s “answer that she was in violation”).  Nor is there any dispute that Gums Dental’s willful neglect was “not corrected” at any point from August 26, 2019 through March 29, 2022, placing the violation within the culpability tier of 45 C.F.R. § 160.404(b)(2)(iv).  See ALJ Decision at 7, 18 (stating that Gums Dental “did not provide the requested records until May 17, 2022, when it made the records available via Dropbox,” and “[t]he violation was not corrected within 30 days of when [Gums Dental] knew or, by exercising reasonable diligence, would have known that the violation occurred”).

We agree with and affirm the ALJ’s apt summary:

OCR notified [Gums Dental] that it was investigating the AP’s new complaint regarding her and her children’s treatment records in writing on September 5, 2019; by voicemail on October 8, 2019; by telephone on October 31, 2019; in writing via certified mail on November 7, 2019; in writing on October 1, 2020; and in writing on December 8, 2020.  [Gums Dental] had direct knowledge that its actions were possibly in violation of the law and had triggered an OCR investigation.  OCR offered multiple opportunities for informal resolution, but [Gums Dental] still made no effort to ensure compliance with the HIPAA Privacy Rule.  [Gums Dental] never acted on the AP’s written request for access to the treatment records until after receiving the NPD.  [Gums Dental] did not even timely deny the AP’s request in writing, so the AP could request further review.  Such conduct amounts to reckless indifference to its obligation to comply with the Privacy Rule.  Thus, the “did not know” or “would not have known” tiers could not have applied here.

ALJ Decision at 16.  The ALJ’s conclusions are supported by substantial evidence and free of error.
 

5. The ALJ did not err in concluding that a $70,000 CMP is justified.

“In determining the amount of any civil money penalty, the Secretary,” through OCR, will consider specified factors, “which may be mitigating or aggravating as appropriate.”  45 C.F.R. § 160.408.  Those factors are:

(a) The nature and extent of the violation, consideration of which may include but is not limited to:

Page 19

(1) The number of individuals affected; and
(2) The time period during which the violation occurred;

(b) The nature and extent of the harm resulting from the violation, consideration of which may include but is not limited to:

(1) Whether the violation caused physical harm;
(2) Whether the violation resulted in financial harm;
(3) Whether the violation resulted in harm to an individual's reputation; and
(4) Whether the violation hindered an individual’s ability to obtain health care;

(c) The history of prior compliance with the [relevant] provisions, including violations, by the covered entity or business associate, consideration of which may include but is not limited to:

(1) Whether the current violation is the same or similar to previous indications of noncompliance;
(2) Whether and to what extent the covered entity or business associate has attempted to correct previous indications of noncompliance;
(3) How the covered entity or business associate has responded to technical assistance from the Secretary provided in the context of a compliance effort; and
(4) How the covered entity or business associate has responded to prior complaints;

(d) The financial condition of the covered entity or business associate, consideration of which may include but is not limited to:

(1) Whether the covered entity or business associate had financial difficulties that affected its ability to comply;
(2) Whether the imposition of a civil money penalty would jeopardize the ability of the covered entity or business associate to continue to provide, or to pay for, health care; and
(3) The size of the covered entity or business associate; and

(e) Such other matters as justice may require.

A.     The ALJ did not err in upholding OCR’s determination that the 45 C.F.R. § 160.408(a)-(c) factors were aggravating.

The ALJ concluded, after detailed review of the evidence and the 45 C.F.R. § 160.408 factors, that Gums Dental’s “disregard of OCR’s technical guidance regarding the AP’s complaint and request for cooperation with its investigation over a considerable period of time supports the imposition of a significant CMP of $70,000.”  ALJ Decision at 21.  The

Page 20

ALJ explained that, “[i]n determining the amount of the CMP, OCR found that the factors listed in 45 C.F.R. § 160.408(a)-(c) weighed against Respondent and were aggravating.”  Id. at 18.  Regarding the “nature and extent of the violation” under section 160.408(a), OCR determined that Gums Dental “failed to remedy the potential violation even after multiple technical assistance and data request letters, and the violation occurred for over two years.”  Id.  Regarding the “nature and extent of the harm resulting from the violation” under section 160.408(b), OCR determined that Gums Dental denied the AP’s family access to dental care due to OCR’s investigation and the AP “could not seek insurance reimbursement” for Gums Dental’s services due to its “refusal to provide the records.”  Id.  Regarding Gums Dental’s “history of compliance” under section 160.408(c), OCR acknowledged it had received no other complaints against Gums Dental, but “determined that [Gums Dental] ignored OCR’s May 7, 2019, technical assistance letter and the September 5 and November 7, 2019, data requests attempting to resolve” the AP’s allegations.  Id.

Gums Dental raises various arguments about the aggravating factors in 45 C.F.R. § 160.408(a)-(c), but none establishes error by the ALJ.  We first reject Gums Dental’s assertion that the ALJ unfairly compared it “with a career institute in Texas.”  Reply at 2.  It is true that the applicable regulations “do not call for comparisons with other cases in setting CMP amounts.”  Phoenix at 20 (citing section 160.408).  However, OCR solely referenced evidence specific to Gums Dental in determining the CMP amount, as did the ALJ in reviewing OCR’s proposed determination.  NPD at 7-8; ALJ Decision at 18-22.  The ALJ referenced University of Texas MD Anderson Cancer Center, DAB No. 2927 at 30 (2019), vacated and remanded, 985 F.3d 472 (5th Cir. 2021), only for the proposition that the section 160.408 factors may be either aggravating or mitigating (as the regulation itself plainly states).¹¹   ALJ Decision at 17.

Gums Dental unpersuasively questions the ALJ’s assessment that five individuals – that is, the AP and members of the AP’s family – were “individuals affected” for purposes of 45 C.F.R. § 160.408(a)(1) due to their impaired access to dental care and insurance reimbursement.  Gums Dental asserted before the ALJ that two of the AP’s children had reached adulthood and Gums Dental “could not provide [their] records without the[ir] consent,” RFH at 3, ¶ 27, yet now asserts the adulthood of one (not two) of the AP’s children, RR at 4.  Gums Dental also questions whether the AP’s spouse is “a party in the claim,” and characterizes Gums Dental’s alleged refusal to treat the AP’s spouse as “lies.”  RR at 5-6.  These assertions are not evidence and do not rebut the ALJ’s evidence-based assessment that Gums Dental’s violation of the Privacy Rule hindered the access of the AP’s family members to dental care during the relevant period.  See ALJ Decision at 19; OCR Ex. 20 (September 22, 2020 OCR memorandum of the AP’s report

Page 21

that spouse “called to schedule an appointment with Dr. Gumbs,” who “would not make the appointment because of the pending case with [the AP]”); OCR Ex. 21 (July 6, 2021 OCR record of the AP’s report that spouse previously was “denied an appointment”).  Further, Gums Dental freely admits it “was not going to allow [the AP] to file [additional] dental claims using information we furnished.”  RR at 3.  That admitted intention to prevent the AP’s submission of insurance claims was detrimental to the AP because “[p]atients . . . benefit from the disclosure of [health] information to the health plans that pay for and can help them gain access to needed care.”  See Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. 82,462, 82,467 (Dec. 28, 2000) (Final Rule).  In other words, as the ALJ explained, Gums Dental’s violation “adversely affected” the AP’s family by rendering them “unable to seek insurance reimbursement because they did not have copies of their treatment records.”  ALJ Decision at 19.  Thus, Gums Dental has established no error in the ALJ’s treatment of the section 160.408(a)(1) subfactor as aggravating and as supporting a $70,000 CMP.

Gums Dental also does not rebut the ALJ’s assessment, concerning the “time period during which the violation occurred” for purposes of 45 C.F.R. § 160.408(a)(2), that Gums Dental “failed to remedy the potential violation even after multiple technical assistance and data request letters . . . for over two years.”  ALJ Decision at 18.   Gums Dental disagrees that it withheld the requested records for “almost three years” and “took 15 months to resolve the violation,” arguing that, due to the COVID-19 pandemic, “the court was closed for several weeks and so was our office.”  RR at 4.  Gums Dental does not explain how its unproven closure for several weeks would excuse its proven unresponsiveness to the AP’s and OCR’s requests for many months.  Gums Dental also contends that it “answered the letters received from [OCR] independently,” the “person hired to assist with this case has failed to advocate” as Dr. Gumbs desired, and Gums Dental “did not have great representation in this case.”  RR at 6; Reply at 2.  However, Gums Dental specifies no prejudicial errors by its former legal counsel, and a party may not shift responsibility for its own omissions onto its attorneys in any event.  See Phoenix at 11 (“As the covered entity, however, Respondent was responsible for complying with the Privacy Rule requirements and may not shield itself from violations of those requirements by delegating the responsibility for compliance, and the consequences of failing to do so, to its business associate law firm.”); Norman Johnson, M.D., DAB No. 2779, at 18 (2017) (“Petitioner is accountable for his lawyer’s omission.”).  Whatever legal and operational challenges Gums Dental might have faced, it has established no error by the ALJ in treating the section 160.408(a)(2) subfactor as an aggravating one that supports a $70,000 CMP.

Regarding the “harm resulting from the violation” under 45 C.F.R. § 160.408(b), the record again supports the ALJ’s and OCR’s determinations that this regulatory factor is aggravating.  See ALJ Decision at 18.  Gums Dental’s only counterarguments are too late, unpersuasive, or both.  Gums Dental now “disagree[s]” that the AP’s spouse “was denied access to care at Gums Dental,” newly proffers the “complete record” of the AP’s spouse as support, and claims the AP suffered “zero” harm.  Reply at 2.  However, Gums

Page 22

Dental never presented these arguments or evidence to the ALJ, who accordingly stated that Gums Dental “has not denied this allegation.”  ALJ Decision at 15 (citing OCR Exs. 20, 21).  As explained above, Gums Dental may not raise such new issues now, including by proffering evidence that was producible but not produced before the ALJ.  See 45 C.F.R. § 160.548(e).  Thus, Gums Dental has established no error in the ALJ’s treatment of the section 160.408(b) factor as an aggravating one that supports a $70,000 CMP.

Gums Dental also fails to rebut the ALJ’s determination that the “history of prior compliance” factor in 45 C.F.R. § 160.408(c) was aggravating and supported the CMP.  ALJ Decision at 18.  Gums Dental disagrees that it “did not cooperate” and that OCR’s “letters were not answered.”  RR at 6.  However, the evidence shows that Gums Dental ignored OCR’s written communications of May 7, September 5, and November 7 of 2019, and Gums Dental produced no evidence of a single timely and cooperative response to those letters.  NPD at 8, ¶ 3; RR at 6.  As the ALJ accurately summarized, “[t]hrough Dr. Gumbs, [Gums Dental] either did not respond to OCR’s communications, advised OCR that Respondent did not intend to provide the AP with the requested records,” or “conceded that Respondent had not provided” them.  ALJ Decision at 19 (citing OCR Exs. 7, 11-12, 16).  We thus affirm the ALJ’s treatment of the section 160.408(c) factor as an aggravating one that supports a $70,000 CMP.

For these reasons, the ALJ did not err in upholding OCR’s determination that the factors in 45 C.F.R. § 160.408(a)-(c) were aggravating and supported a $70,000 CMP.

B.     The ALJ did not err in upholding OCR’s determination that the 45 C.F.R. § 160.408(d) factor was mitigating, and therefore that OCR permissibly reduced the proposed CMP from over $7,000,000 to $70,000.

Despite the three established aggravating factors in 45 C.F.R. § 160.408(a)-(c), the ALJ upheld OCR’s determination to treat Gums Dental’s “financial condition” as mitigating and accordingly to reduce the proposed CMP from over $7,000,000 to $70,000.¹²   Before OCR issued its NPD, Gums Dental had an opportunity to give OCR evidence of financial information, affirmative defenses, or mitigating factors, but failed to do so.  ALJ Decision at 19; OCR Ex. 13, 16.  Nevertheless, from publicly available information, OCR

Page 23

determined that Gums Dental is a solo practitioner and imposing the maximum CMP likely would impact Gums Dental’s ability to provide dental care to its urban and suburban service area.  ALJ Decision at 19-20; NPD at 8.  OCR also determined that the potential impact of the COVID-19 public health emergency warranted a reduced CMP.¹³   ALJ Decision at 20; NPD at 8. 

OCR’s leniency in considering mitigating circumstances reduced the CMP “by over 90 percent,” ALJ Decision at 21, but Gums Dental argues that the 45 C.F.R. § 160.408(d) factor justifies a still greater reduction of the CMP.  Gums Dental argues that it cannot “pay out $70,000.00 and be in great shape financially,” that performing the number of services needed to pay the CMP would be “an impossible task,” and that “Dr. Gumbs has personally sacrificed over the years to be profitable in 2023.”  RR at 6.  Gums Dental argues it “cannot afford to pay bills that are erroneous or unfair.”  Reply at 2.

We find Gums Dental’s arguments concerning its financial condition unpersuasive, and we see no error in the ALJ’s ruling that Gums Dental’s evidence showed “a net income indicating Respondent has a profitable business and the required funds to pay the proposed $70,000 CMP.”  ALJ Decision at 20 (discussing Gums Dental Ex. 11).  Like the ALJ, we do not describe the specific amounts shown on the profit and loss statements that Gums Dental filed, in order to protect their confidentiality, but we agree with the ALJ’s assessment of that evidence.  See Gums Dental Ex. 11, at 1-4, 9-10.  We also agree that Gums Dental did not corroborate its claims that most of its patients are Medicaid recipients, that covering its estimated taxes required 2023 cutbacks in retirement funding and Dr. Gumbs’s salary, and that Gums Dental “has limited insurance coverage for defense costs and payment of the CMP.”  Id.  Gums Dental does not deny it could pay the CMP.  Gums Dental candidly admits it was “profitable in 2023” and “we have been blessed to pay the bills we legitimately owe.”  RR at 6; Reply at 2.  Gums Dental thus shows no error in the ALJ’s assessment that 45 C.F.R. § 160.408(d) constituted a mitigating factor warranting a substantial reduction of the CMP by over 90%, from over $7,000,000 to $70,000, but no further.

C.     The ALJ did not err in upholding OCR’s determination that there is no basis for waiver of the CMP.

The ALJ concluded, without legal error, that Gums Dental is ineligible for a waiver of the CMP.  “OCR may waive a CMP imposed for a violation in certain circumstances,” the ALJ recognized, “but may not waive CMPs imposed for violations due to willful

Page 24

neglect.”  ALJ Decision at 22 (citing 45 C.F.R. § 160.412).  Having upheld OCR’s determination that Gums Dental violated 45 C.F.R. § 164.524(b)(2) through willful neglect, the ALJ correctly upheld OCR’s determination “that there is no basis for waiver of the proposed CMP amount.”  ALJ Decision at 22 (citing NPD at 8).

Gums Dental’s unsupported argument that its former counsel was “irresponsible” in not requesting a waiver of the CMP, RR at 6, is a newly raised one that we cannot consider, see 45 C.F.R. § 160.548(e), and which establishes no error in any event.  The ALJ correctly applied pertinent law, which does not allow waiver of a CMP for a violation due to willful neglect.  See 45 C.F.R. § 160.412 (granting Secretary waiver authority for “violations described in § 160.410(b)(2) or (c)”); id. § 160.410(b)(2) and (c) (defining violation types that are not “due to willful neglect”).  The ALJ correctly stated that Gums Dental bore the burden of persuasion regarding “any waiver arguments.”  ALJ Decision at 9 (citing 45 C.F.R. § 160.534(b)(1)).  The ALJ did not err in concluding that Gums Dental did not meet that burden and was not entitled to waiver of the CMP.

6. The ALJ and the Board cannot grant Gums Dental equitable relief.

Gums Dental’s remaining equitable arguments are fruitless.  For example, Gums Dental opines that “this case was not what [OCR] had in mind” when adopting the “laws quoted in the decision” and the “spirit of [the] law was missed.”  RR at 4-5.  Gums Dental also contends that “the primary payer” should have been involved and a particular OCR attorney should “be investigated.”  Id. at 3, 5.  However, the ALJ “[m]ay not find invalid or refuse to follow Federal statutes, regulations, or Secretarial delegations of authority” for such reasons.  45 C.F.R. § 160.508(c)(1).  In comparable cases, the Board has made clear that equitable relief is not available.  See Copperas Cove at 35 (“The Board has held that neither it nor an ALJ is authorized to grant a non-federal party relief from [an] enforcement action based on equitable defenses or doctrines . . . and that an administrative appeal of such an action must be decided based on applicable statutes and regulations.”) (citing cases); Central Kan. Cancer Inst., DAB No. 2749, at 10 (2016) (stating that the Board “is bound by the regulations, and may not choose to overturn [an] agency’s lawful use of its regulatory authority based on principles of equity”).  Even if we could address Gums Dental’s claims of inequitable overreach by OCR, we would find them unpersuasive.  We hold that the OCR acted well within the scope of its authority, and that its NPD and the ALJ Decision upholding it are consistent with the letter and spirit of the governing law.

Page 25

Conclusion

We affirm the ALJ Decision upholding the OCR’s determination that Gums Dental violated 45 C.F.R. § 164.524(b)(2) from August 26, 2019 through March 29, 2022 at the level of willful neglect and was appropriately subject to a CMP of $70,000. 

ENDNOTES