Hackensack Meridian Health, West Caldwell Care Center

Office of the Secretary
Hubert H. Humphrey Building
200 Independence Avenue, S.W.
Washington, D.C. 20201
http://www.hhs.gov/ocr

January 12, 2024

Via email and certified mail (Return receipt requested)

David Quinn Gacioch, Esq.
McDermott Will & Emory
200 Clarendon Street
Boston, MA 02116
dgacioch@mwe.com

Re: Hackensack Meridian Health, West Caldwell Care Center
OCR Reference Number: 20-391942

Notice of Final Determination

Dear Mr. Gacioch:

Pursuant to the authority delegated by the Secretary of the United States Department of Health and Human Services (HHS) to the Director of the Office for Civil Rights (OCR), I am writing to inform you that the civil money penalty (CMP) of $100,000.00 against Essex Residential Care LLC, doing business as Hackensack Meridian Health, West Caldwell Care Center (hereafter referred to as "WCCC") is final. This letter also contains instructions for WCCC to make payment of the CMP amount.

I.       WCCC is Waiving the Right to Request a Hearing Before an Administrative Law  Judge and Petition for Judicial Review

By letter dated September 7, 2023, OCR issued WCCC a Notice of Proposed Determination (attached hereto), informing WCCC that OCR was proposing to impose a CMP in the amount of $100,000.00 and the findings of the facts forming the basis for the CMP. The Notice of Proposed Determination notified WCCC of its right to request a hearing on the proposed CMP within ninety (90) days of the date of receipt of the letter and provided instructions on requesting a hearing with the Departmental Appeals Board. The Notice of Proposed Determination further advised that failure to request a hearing within this time period could result in the imposition of the proposed CMP without a hearing under 45 C.F.R. §160.504 or the right of appeal under 45 C.F.R. § 160.548. WCCC received the Notice of Proposed Determination on September 7, 2023, via email and when it was delivered by a duly registered process server on WCCC’s counsel’s Assistant, Bobby Deangelico, who confirmed he was expressly authorized to accept process for WCCC’s counsel, David Gacioch. WCCC also received it on September 8, 2023, when it was delivered by certified mail, return receipt requested.

By letter dated December 6, 2023, sent via email to OCR, WCCC’s counsel advised that WCCC waives its right to a hearing pursuant to 45 C.F.R. §160.420(b), is not contesting the findings of OCR’s proposed determination, and will pay the $100,000.00 CMP.

Accordingly, by operation of WCCC’s waiver of its procedural rights to challenge the CMP under 45 C.F.R. Part 160 Subparts D and E and 42 U.S.C. § 1320a-7a, the CMP referenced above is now final. Therefore, pursuant to the authority delegated by the Secretary of HHS to the Director of OCR, I am authorized to impose the CMP against WCCC in the full amount of $100,000, as set forth in the Notice of Proposed Determination.

II.   No Right of Appeal

WCCC has no right to appeal the imposition of the CMP under 45 C.F.R. § 160.548 since WCCC chose to waive its right to appeal OCR’s proposed determination and to request a hearing.

III. Instructions for Payment of the CMP Amount

Payment of the full and aggregate amount of $100,000.00 is due upon WCCC’s receipt of this Notice of Final Determination. Payment can be made in accordance with the instructions on Exhibit 1 to this Notice.

IV. Consequences of Nonpayment

In the event that payment is not received upon WCCC’s receipt of this Notice of Final Determination, a civil action may be brought in the United States District Court to recover the amount of the penalty.

V.      The Legal Basis for This Action

This action is being taken under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), § 262(a), Pub.L. 104-191, 110 Stat. 1936, as amended, codified at 42 U.S.C. § 1320d-5, and under the enforcement regulations at 45 C.F.R. Part 160, subpart D. The Secretary of HHS is authorized to impose CMPs (subject to the limitations at 42 U.S.C. § 1320d-5(b)) against any covered entity, as described at 42 U.S.C. § 1320d-l(a), that violates a provision of Part C (Administrative Simplification) of Title XI of the Social Security Act. See 42 U.S.C. § 1320d- 5(a), as amended. This authority extends to violations of the regulations commonly known as the Privacy Rule promulgated at 45 C.F.R. Part 160 and subparts A and E of Part 164, pursuant to Section 264(c) of HIPAA. The Secretary has delegated enforcement responsibility for the Privacy Rule to the Director of OCR. See Office for Civil Rights; Statement of Delegation of Authority, 65 Fed. Reg. 82381 (Dec. 28, 2000).

If you have any questions concerning this letter, please contact Linda C. Colón, Regional Manager, OCR, Eastern and Caribbean Region, at (212) 264-4136.

Sincerely,

                                                                                    /s/

Melanie Fontes Rainer Director
Office for Civil Rights
U.S. Department of Health and Human Services

Enclosed:
Payment Instructions

Notice of Proposed Determination (September 7, 2023)

Civil Money Penalty Payment Instructions

The Civil Money Penalty (CMP) is to be submitted through Pay.gov. The method of funds transfer in Pay.gov is ACH debit. If your organization is using a business checking account for payment, please note that most business checking accounts have ACH debit blocks on them. This may result in the payment being returned by the bank for payments not authorized. To avoid this, please contact your financial institution and request that it remove the ACH debit block for this transaction. To do this, the bank will typically need the Originating Company ID for the originator of the ACH debit. That number, called the ALC+2, is 7503003008. You will need to give this information to your bank.

As soon as possible, please provide OCR with the name, title, email and physical address of the individual who will be responsible for completing the electronic payment. This information is needed to send the e-invoice for the CMP amount. This individual will be receiving an email invoice from Pay.gov with specific instructions on how to complete the transfer via secure electronic funds transfer. OCR also requires documentation of your organization’s EIN/TIN (a screenshot is sufficient).

Payment must be submitted upon receipt of the e-invoice.

Eastern & Caribbean Region
Jacob Javits Federal Bldg.
26 Federal Plaza ● New York, NY 10278
Voice - (800) 368-1019 ● TDD – (800) 537-7697
Fax - (212) 264-3039 ● http://www.hhs.gov/ocr

September 7, 2023

Via personal service, certified mail return receipt requested, and email: 
dgacioch@mwe.com

David Gacioch, Esq.,
McDermott Will & Emery LLP
200 Clarendon Street
Boston, Massachusetts 02116

Re: Hackensack Meridian Health, West Caldwell Care Center OCR Reference Number: 20-391942

Notice of Proposed Determination

Dear Mr. Gacioch:

Pursuant to the authority delegated by the Secretary of the United States Department of Health and Human Services (HHS) to the Office for Civil Rights (OCR), I am writing to inform you that OCR is proposing to impose a civil money penalty (CMP) of $100,000 against Essex Residential Care, LLC, doing business as Hackensack Meridian Health, West Caldwell Care Center (WCCC).1

This proposed action is being taken under the regulations promulgated by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), § 262(a), Pub.L. 104-191, 110 Stat. 1936, as amended by the Health Information Technology for Economic and Clinical Health (“HITECH”) Act, Public Law 111-5, Section 13410, codified at 42 U.S.C. § 1320d-5, and under 45 C.F.R. Part 1600, Subpart D.

I.  The Statutory Basis for the Proposed CMP

The Secretary of HHS is authorized to impose a CMP (subject to the limitations set forth at 42 U.S.C. § 1320d- 5(b)) against any covered entity, as described at 42 U.S.C. § 1320d-1(a), that violates a provision of Part C (Administrative Simplification) of Title XI of the Social Security Act. See HIPAA, §

Page 2 – Mr. Gacioch

262(a), as amended, 42 U.S.C. § 1320d-5(a). This authority includes violations of the applicable provisions of the Federal Standards for Privacy of Individually Identifiable Health Information and the Security Standards for the Protection of Electronic Protected Health Information (45 C.F.R. Parts 160 and 164, Subparts A, C, and E, the Privacy and Security Rules), and the Breach Notification Rule (45 C.F.R. Parts 160 and 164, Subpart D), pursuant to Section 264(c) of HIPAA. The Secretary has delegated enforcement responsibility for the HIPAA Rules to the Director of OCR. See 65 Fed. Reg. 82,381 (Dec. 28, 2000) and 74 Fed. Reg. 38630 (July 27, 2009). The Secretary is authorized under the HITECH Act § 13410, 42 U.S.C. § 1320d-5(a)(3),2 to impose CMPs for violations occurring on or after February 18, 2009,3 of:

  • A minimum of $100 for each violation where the covered entity or business associate did not know and, by exercising reasonable diligence, would not have known that the covered entity or business associate violated such provision, except that the total amount imposed on the covered entity or business associate for all violations of an identical requirement or prohibition during a calendar year may not exceed $25,000.
  • A minimum of $1,000 for each violation due to reasonable cause and not to willful neglect, except that the total amount imposed on the covered entity or business associate for all violations of an identical requirement or prohibition during a calendar year may not exceed $100,000. Reasonable cause means an act or omission in which a covered entity or business associate knew, or by exercising reasonable diligence would have known, that the act or omission violated an administrative simplification provision, but in which the covered entity or business associate did not act with willful neglect.
  • A minimum of $10,000 for each violation due to willful neglect and corrected within 30 days, except that the total amount imposed on the covered entity or business associate for all violations of an identical requirement or prohibition during a calendar year may not exceed $250,000.
  • A minimum of $50,000 for each violation due to willful neglect and uncorrected within 30 days, except that the total amount imposed on the covered entity or business associate for all violations of an identical requirement or prohibition during a calendar year may not exceed $1,500,000.

As required by law, OCR has adjusted the CMP ranges for each penalty tier for inflation.4 The adjusted amounts are applicable only to CMPs whose violations occurred after November 2, 2015.

Page 3 – Mr. Gacioch

OCR is precluded from imposing a CMP unless the action is commenced within six years from the date of the violation.5

II.            Findings of Fact

  1. WCCC is a skilled nursing facility with 180 certified beds, located in West Caldwell, New
  1. WCCC is a “covered entity” within the definition set forth at 45 F.R. § 160.103, and, as such, is required to comply with the requirements of the HIPAA Privacy, Security, and Breach Notification Rules.
  1. WCCC is a health care provider that transmits health information in electronic form in connection with transactions for which the S Department of Health and Human Services has adopted standards.
  1. WCCC creates, maintains, receives, and transmits protected health information (PHI) of patients who receive health care services from WCCC.
  2. Under the HIPAA Privacy Rule, an individual's personal representative6has the right to access PHI about the individual in a designated record set, for as long as the PHI is maintained by a covered entity in the designated record set.7
  1. On April 19, 2020, Peter Lindsay, the complainant requested a copy of his mother’s medical record from WCCC via email.
  1. The complainant’s initial request was denied via email on April 22, 2020, by the WCCC administrator, who requested that the complainant provide WCCC a copy of a power of attorney, medical proxy or similar document executed by the mother establishing that he was Louis Lindsay’s personal representative.
  1. WCCC acknowledged that on April 23, 2020, the complainant sent and WCCC received a copy of the complainant’s power of attorney via email establishing the complainant as his mother’s personal representative pursuant to 45 C.F.R. § 164.502(g).
  1. WCCC did not provide the complainant with access to the requested records after receiving the complainant’s power of attorney documentation.
  1. On May 19, 2020, the complainant, filed a complaint with OCR, on behalf of his mother, Lois Lindsay (mother) alleging that WCCC failed to provide him with a copy of his mother’s medical record. The complainant was personal representative of his mother pursuant to 45 C.F.R. § 164.502(g), and as such, WCCC was required to take timely action in response to this medical records request.

Page 4 – Mr. Gacioch

  1. On October 15, 2020, OCR notified WCCC of its investigation of the complaint alleging that WCCC denied the complainant their right of access. The notification included notice of the complaint filed against WCCC and a data request concerning this right of access request.
  1. The HIPAA Privacy Rule requires that a covered entity “must act on a request for access no later than 30 days after receipt of the request”. 45 C.F.R. § 164.524(b)(2).
  1. A covered entity can respond to a right of access request by granting or denying the request in whole or in part, or if it is unable to take an action required, it may extend the timeframe for responding by additional 30 days by sending the requestor a written statement of the reasons for the delay and the date by which the covered entity will complete its action on the request. 45 C.F.R. § 164.524(b)(2).
  1. In its response to OCR’s data requests, WCCC acknowledged that it failed to respond to the complainant’s request for his mother’s medical records within 30 days of receiving the complainant’s written request for the records.
  1. The Privacy Rule required WCCC to respond to the complainant’s request for access for Lindsay’s medical records no later than 30 days after receiving the complainant’s request, or on or before May 23, 2020.
  1. WCCC provided the complainant with the request records on December 1, 2020, 161 days after the complainant’s request.
  1. By letter dated March 25, 2022, OCR informed WCCC of the results of its investigation that WCCC failed to provide timely access to protected health information with a letter sent certified mail with return receipt requested and via email. This letter offered WCCC an opportunity to settle this matter informally and encouraged WCCC to contact OCR no later than ten days of receipt of the letter.
  1. On April 29, 2022, OCR received an email correspondence from the WCCC’s attorney stating WCCC’s disagreement with OCR’s proposed resolution of this matter.
  1. On May 16, 2022, pursuant to 45 C.F.R. § 160.312(a)(3), OCR issued a Letter of Opportunity (LOO) informing WCCC that OCR found preliminary indications of non-compliance and providing WCCC with an opportunity to submit written evidence of mitigating factors under 45 F.R. § 160.408 or affirmative defenses under 45 C.F.R. § 160.410 for OCR’s consideration in making a determination of a CMP pursuant to 45 C.F.R. § 160.404. The letter stated WCCC could also submit written evidence to support a waiver of a CMP for the indicated areas of non-compliance. Each act of noncompliance was described in the letter.
  2. On June 15, 2022, WCCC, through its attorney, provided a response to OCR’s LOO. In its response, WCCC acknowledged that on April 19, 2020, it received an email from the complainant requesting a copy of his mother, Lois Lindsay’s medical WCCC also noted

Page 5 – Mr. Gacioch

  1. that it requested, and the Complainant provided a power of attorney on April 23, 2020. WCCC also acknowledged that WCCC staff failed to provide the Complainant with a copy of the Ms. Louis Lindsay’s medical record, and instead, provided a copy of the mother’s medical records to another facility to which Ms. Lindsay was transferred. WCCC indicated that at the time of the original request, both the Complainant and the mother were parties to ongoing litigation with WCCC over non-payment for care. WCCC also indicated that it was struggling with the COVID- 19 pandemic. WCCC’s attorney asserts that the Complainant sent his request for a copy of his mother’s medical records by email and then filed his complaint with OCR exactly 30 days later— before WCCC’s response to the initial request was due. WCCC’s attorney indicated that WCCC acknowledges it should have handled the Complainant’s request differently by providing the Complainant with a copy of the requested medical record by May 23, 2020. WCCC also provided the affirmative defenses listed in Section IV, below.

III.  Basis for CMP

Based on the above findings of fact, OCR has determined that WCCC is liable for the following violation of the HIPAA Rules and, therefore, is subject to a CMP.

  1. From June 23, 2020, to December 1, 2020, WCCC failed to provide the Complainant with access to the mother’s PHI in violation of 45 C.F.R. § 164.524(a).

OCR calculated the CMP at the reasonable cause not corrected under 45 C.F.R. § 160.404(b)(2)(ii)(A).

IV.  Affirmative Defenses

WCCC provided the following affirmative defenses in its LOO response letter to OCR dated June 15, 2022:

  1. WCCC states that HIPAA bars the imposition of a CMP in this case, as a matter of law, because any violation was not due to willful neglect and was timely corrected.

OCR determined that this does not meet the affirmative defense requirements as the violation was not timely corrected as required at 45 C.F.R. § 160.410(c).

  1. WCCC also states that the imposition of a CMP under these circumstances would be arbitrary and capricious and would violate the Administrative Procedure Act (APA).

The proposed penalty is appropriate and reasonable given the referenced violation of the Privacy Rule and does not violate the APA.

  1. WCCC also states that OCR should waive any possible CMP, pursuant to 45 F.R. § 160.412, because any CMP would be excessive relative to the alleged violation.

Specifically, WCCC asserts that if OCR were to conclude that its affirmative defenses do not apply, it should waive any CMP pursuant to 45 C.F.R. § 160.412 because the violation at issue is a failure to

Page 6 – Mr. Gacioch

timely respond to a single request for records access, submitted in the midst of litigation with the Complainant and during the COVID-19 pandemic. WCCC asserts that WCCC’s personnel mistakenly believed that an appropriate, timely response to the complainant’s medical record request had been made through the transfer of the patient to another facility.

The proposed penalty is reasonable and not excessive relative to the violation. 45 C.F.R. § 160.412.

V.  Factors Considered in Determining the Amount of the CMP Pursuant to 45 C.F.R. § 160.408

In accordance with 45 C.F.R. §160.408, OCR considered WCCC’s response to its LOO and the evidence obtained during its investigation in determining the amount of the CMP. OCR considered the factors as follows:

  1. 45 F.R. § 160.408(a) - The nature and extent of the violation.

    While the violation affected only the complainant and his mother, WCCC failed to provide timely access to the mother’s medical record to the complainant from June 23, 2020 – December 1, 2020, a period of 161 days, a significant period of time. As such, OCR finds this is a neutral factor, with mitigating and aggravating considerations canceling each other out.

  2. 45 F.R. § 160.408(b) - The nature and extent of the harm resulting from the violation.

    OCR does not have evidence of any harm; however, this good fortune is not attributable to any actions by WCCC. As such, OCR finds this is neither a mitigating nor aggravating factor.

  1. 45 C.F.R. § 160.408(c) - The history of prior compliance with the administrative simplification provisions, including violations, by the covered entity.

    Based on a review of OCR’s history with this covered entity, there have been no previous investigations of WCCC that involve the same or similar noncompliance at issue in this matter. As such, OCR has insufficient information on which to assess whether and to what extent WCCC has attempted to correct previous indications of noncompliance or how WCCC has responded to prior complaints or OCR technical assistance. However, the fact that OCR has never investigated an entity is not an automatic indication of prior compliance with the HIPAA Rules, as evident in this investigation where noncompliance has in fact been identified. As such, OCR finds that this is neither a mitigating nor aggravating factor.

  1. 45 F.R. § 160.408(d) - The financial condition of the covered entity.

    OCR found no evidence to suggest that WCCC experienced financial difficulties that affected its ability to comply with HIPAA requirements. WCCC is a small entity but as indicated above, there is no indication that it is in poor financial condition such that it would be unable to pay the proposed CMP. OCR found no evidence that the imposition of the CMP would impact WCCC’s ability to continue to provide health care to its patients The ability to pay a CMP alone, is an insufficient basis to support aggravation of a CMP.

    As such, OCR finds that this is neither a mitigating nor aggravating factor.

Page 7 – Mr. Gacioch

  1. 45 F.R. § 160.408(e) - Such other matters as justice may require.

    OCR found no other factors that would affect the amount of the proposed CMP. OCR considers this factor to be neither mitigating nor aggravating.

VI.  Amount of CMP

Based on OCR’s evaluation of the factors listed in 45 C.F.R. § 160.408, OCR finds WCCC is liable, with regard to the violation described in Section III:

  1. Right of Access (45 CFR § 164.524(a)(1)): The CMP is $100,000. This CMP amount is based on 45 CFR § 160.404(b)(2)(ii).

    The appropriate penalty tier for this violation from June 23, 2020, to December 1, 2020, 2020, is Reasonable Cause, as follows:

    Calendar Year 2020: 161 days at $1,280 per day (Maximum potential CMP of $206,080)

    Total Maximum CMP: $206,080, capped at $100,0008

VII.  Right to a Hearing

WCCC has the right to a hearing before an administrative law judge to challenge these proposed CMPs. To request a hearing to challenge these proposed CMPs WCCC must mail a request, via certified mail with return receipt request, under the procedures set forth at 45 C.F.R. Part 160 within 90 days of your receipt of this letter. Such a request must: (1) clearly and directly admit, deny, or explain each of the findings of fact contained in this notice; and (2) state the circumstances or arguments that you allege constitute the grounds for any defense, and the factual and legal basis for opposing the proposed CMPs. If you wish to request a hearing, you must submit your request to:

Department of Health & Human Services
Departmental Appeals Board, MS 6132
Civil Remedies Division
330 Independence Ave, SW

Cohen Building, Room G-644
Washington, D.C. 20201
Telephone: (202) 565-9462

Copy to:

Page 8 – Mr. Gacioch

Ms. Linda C. Colón
Office for Civil Rights
26 Federal Plaza
Room 19-501
New York, NY 10278
Linda.colon@hhs.gov
Telephone: (212) 264-4136

A failure to request a hearing within 90 days permits the imposition of the proposed CMPs without a right to a hearing under 45 C.F.R. § 160.504 or a right of appeal under 45 C.F.R. § 160.548. If you choose not to contest this proposed CMP, you should submit a written statement accepting its imposition within 90 days of receipt of this notice.

If WCCC does not request a hearing within 90 days, then OCR will notify WCCC of the imposition of the CMPs through a separate letter, including instructions on how to make payment and the CMPs will become final upon receipt of such notice.

If you have any questions, you may contact me at (212) 264-4136 or linda.colon@hhs.gov.

Sincerely,

                      /s/

Linda C. Colón
Regional Manager

cc: Send Via Email: Cynthia.Coronel@HackensackMeridian.org
Cynthia Coronel-Becker, CHPC
Director, Privacy
Hackensack Meridian Health, West Caldwell Care Center

Endnotes

1The covered entity is owned by an entity named Essex Residential Care, LLC, doing business as Hackensack Meridian Health West Caldwell Care Center. The covered entity is owned 51% by Hackensack Meridian Health Residential Care, Inc., a nonprofit corporation, and 49% Eagle Rock Convalescent Center, Inc., a business corporation. The joint venture was effective on July 1, 2019. Hackensack Meridian Health Residential Care, Inc. is a wholly controlled subsidiary of Hackensack Meridian Health, Inc.

2 The CMPs reflect the penalty tiers described in the Notification of Enforcement Discretion (April 30, 2019). See https://www.federalregister.gov/documents/2019/04/30/2019-08530/notification-of-enforcement-discretion-regarding-hipaa-civil-money-penalties.

3 For violations occurring on or after November 3, 2015, HHS may make annual adjustments to the CMP amounts pursuant to the Federal Civil Penalties Inflation Adjustment Act Improvement Act of 2015, Sec. 701 of Public Law 114-74. The annual inflation amounts are found at 45 C.F.R. §102.3.

4Id.

5 See 42 U.S.C. § 1320a-7a(c)(1); 45 C.F.R. § 160.414 and § 160.104.

6 45 C.F.R. 164.502 (g)

7 45 C.F.R. § 164.524(a).

8 See OCR Notification of Enforcement Discretion (April 30, 2019) https://www.federalregister.gov/documents/2019/04/30/2019-08530/notification-of-enforcement-discretion-regarding-hipaa-civil-money-penalties.

Content created by Office for Civil Rights (OCR)
Content last reviewed