Notice of Proposed Determination - Dr. Linda L. Shen d/b/a Shen Smiles, P.C.

VIA PERSONAL SERVICE, CERTIFIED MAIL RETURN RECEIPT REQUESTED, and EMAIL

July 31, 2024

Mr. Andrew J. Katsock, III, Esq.
███████
███████
Via email: ███████

Linda Shen, DDS
Shen Smiles, PC
███████
Via email: ███████

Re: Shen Smiles, PC

OCR Transaction Number: 20-380382

Dear Mr. Katsock and Dr. Shen:

Pursuant to the authority delegated by the Secretary of the U.S. Department of Health and Human Services (HHS) to the Office for Civil Rights (OCR), I am writing to inform you that OCR is proposing to impose a civil money penalty (CMP) of $140,000 against Shen Smiles, PC (Shen Smiles).

This proposed action is being taken under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), § 262(a), Public Law 104-191, 110 Stat. 1936, as amended by the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009, Public Law 111-5, Section 13410, codified at 42 United States Code (U.S.C.) § 1320d-5, and under 45 C.F.R. Parts 160 and 164.

I. The Statutory Basis for the Proposed CMP

The Secretary of HHS is authorized to impose a CMP (subject to the limitations set forth at 42 U.S.C. § 1320d-5(b)) against any covered entity, as described at 42 U.S.C. § 1320d-1(a), that violates a provision of Part C (Administrative Simplification) of Title XI of the Social Security Act. See HIPAA, § 262(a), as amended, 42 U.S.C. § 1320d-5(a). This authority includes imposing CMPs for violations of the applicable provisions of the Federal Standards for Privacy of Individually Identifiable Health Information and the Security Standards for the Protection of Electronic Protected Health Information (45 Code of Federal Regulations (C.F.R.) Parts 160 and 164, Subparts A, C, and E, the Privacy and Security Rules), and the Breach Notification Rule (45 C.F.R. Parts 160 and 164, Subpart D). The Secretary has delegated enforcement responsibility for the HIPAA Rules to the Director of OCR. See 65 Federal Register (Fed. Reg.) 82381 (Dec. 28, 2000) and 74 Fed. Reg. 38630 (July 27, 2009). OCR is authorized under the HITECH Act § 13410, 42 U.S.C. § 1320d-5(a)(3),1 to impose CMPs for violations occurring on or after February 18, 2009,2 of:

  • A minimum of $100 for each violation where the covered entity or business associate did not know and, by exercising reasonable diligence, would not have known that the covered entity or business associate violated such provision, except that the total amount imposed on the covered entity or business associate for all violations of an identical requirement or prohibition during a calendar year may not exceed $25,000.
  • A minimum of $1,000 for each violation due to reasonable cause and not to willful neglect, except that the total amount imposed on the covered entity or business associate for all violations of an identical requirement or prohibition during a calendar year may not exceed $100,000. Reasonable cause means an act or omission in which a covered entity or business associate knew, or by exercising reasonable diligence would have known, that the act or omission violated an administrative simplification provision, but in which the covered entity or business associate did not act with willful neglect.
  • A minimum of $10,000 for each violation due to willful neglect and corrected within 30 days, except that the total amount imposed on the covered entity or business associate for all violations of an identical requirement or prohibition during a calendar year may not exceed $250,000.
  • A minimum of $50,000 for each violation due to willful neglect and uncorrected within 30 days, except that the total amount imposed on the covered entity or business associate for all violations of an identical requirement or prohibition during a calendar year may not exceed $1,500,000.

As required by law, OCR has adjusted the CMP ranges for each penalty tier for inflation.3 The adjusted amounts are applicable only to CMPs whose violations occurred after November 2, 2015.

OCR is precluded from imposing a CMP unless the action is commenced within six years from the date of the violation.4

II. Findings of Fact

  1. Shen Smiles is a dental practice maintained as a solo practice. It is legally organized as a professional corporation. Dr. Linda Shen (Dr. Shen) is the principal of the practice. Shen Smiles maintains an office in Drums and Tamaqua, Pennsylvania.
  2. Shen Smiles is a health care provider that transmits health information in electronic form in connection with transactions for which the U.S Department of Health and Human Services has adopted standards. Shen Smiles accepts multiple health care insurance plans, including Pennsylvania Medicaid, to which it submits claims electronically.
  3. Shen Smiles creates, maintains, receives, and transmits protected health information (PHI) related to patients for whom Shen Smiles provides dental care.
  4. Shen Smiles is a “covered entity” within the meaning of 45 C.F.R. § 160.103, and, as such, is required to comply with the requirements of the Privacy, Security, and Breach Notification Rules.
  5. Because Shen Smiles is a covered entity under HIPAA, it is required to comply with the HIPAA Privacy Rule, which includes reasonably safeguarding PHI from any intentional or unintentional use or disclosure,5 implementing HIPAA compliant policies and procedures,6 and maintaining those policies and procedures provided for in 45 C.F.R. § 164.530(i) in written or electronic form.7 As a covered entity Shen Smiles is also required to comply with the HIPAA Breach Notification Rule.8
  6. On April 21, 2020, OCR received a complaint on behalf of a former patient (Affected Party) against Shen Smiles. The Complainant is Affected Party’s attorney.
  7. Complainant alleged that Shen Smiles did not provide Affected Party with access to Affected Party’s PHI following multiple access requests made by Affected Party and Complainant.
  8. Under the HIPAA Privacy Rule, an individual has a right of access to inspect and obtain a copy of PHI about the individual in a designated record set9 for as long as the PHI is maintained by the covered entity in the designated record set.10
  9. On May 20, 2020, OCR notified Shen Smiles in writing of the complaint and its intent to investigate the matter and OCR issued a data request. OCR requested data including, among other things, a copy of Shen Smiles’ HIPAA policies and procedures regarding the Privacy Rule’s Individual Right of Access to PHI.
  10. On August 12, 2020, Shen Smiles responded to OCR through its attorney. It did not provide the requested data and objected to the data request.
  11. In response, HHS’s Regional Office of General Counsel (OGC) sent a letter to Shen Smiles on January 11, 2021, requesting that Shen Smiles provide the requested data for OCR’s investigation of the allegations. Shen Smiles submitted an Affidavit of Dr. Shen without any of the other data that OCR requested.
  12. In the Affidavit, Dr. Shen states that the records requested by Affected Party do not exist in the possession, custody and control of Shen Smiles or herself with the exception of a “Single Family Ledger” that was attached to the Affidavit.11 Dr. Shen stated in the sworn Affidavit that the records were stolen from the practice by a workforce member.
  13. Following its receipt of the Affidavit, on February 24, 2021, OCR sent a subsequent data request to Shen Smiles. OCR requested the same data as in the May 20, 2020, initial data request concerning the access allegations of the complaint, since Shen Smiles had not yet provided the data OCR requested initially. Furthermore, OCR requested additional data related to the newly reported illegal removal of patient records from Shen Smiles’ office. OCR’s February 24, 2021, letter requested, among other things, that Shen Smiles provide its policies and procedures evidencing compliance with 45 C.F.R. § 164.530(c) Safeguards; 45 C.F.R. § 164.502(a) Uses and Disclosures of Protected Health Information; and 45 C.F.R. § 164.404-164.408 Notice of Breach, as well as copies of any breach notifications related to this incident.
  14. On April 25, 2021, Shen Smiles responded to OCR’s February 24, 2021, data request. In the response, with respect to the request for a copy of Shen Smiles’ internal policies and procedures evidencing compliance with 45 C.F.R. § 164.524, the response is “None.” With respect to the request for policies and procedures evidencing compliance with 45 C.F.R. §§ 164.530(c); 164.502(a) and 164.404-408, the response is also “None.”
  15. Shen Smiles has not provided evidence that it implements policies and procedures with respect to PHI that are designed to comply with both the Privacy Rule and the Breach Notification Rule, as required by 45 C.F.R. § 164.530(i).
  16. OCR’s investigation determined that Shen Smiles does not reasonably safeguard PHI from any intentional or unintentional use or disclosure of PHI that would violate the requirements of the Privacy Rule, as required by 45 C.F.R. § 164.530(c). OCR learned during its investigation that:
    1. Patient records are not maintained in order and are not in locked file cabinets or otherwise physically safeguarded. Patient records are stored in unsecure locations including in clear plastic boxes in the hygienist’s office, on the floor, and in boxes in a private bathroom.
    2. Records are carried from one practice location to the other and to Dr. Shen’s home and are regularly missing when patients arrive for appointments.
    3. Dr. Shen believed that a former office manager illegally took records from the practice, including Affected Party’s records. Dr. Shen stated that she did not reprimand or discipline the employee or take other action to stop the behavior.
    4. Shen Smiles did not provide its employees any formal HIPAA Privacy Rule training.
  17. OCR notified Shen Smiles of the results of OCR’s investigation by email on November 27, 2023, and by U.S. Mail on November 28, 2023, and offered Shen Smiles an opportunity to resolve the matter informally.
  18. Shen Smiles responded to OCR through counsel on December 3, 2023, and declined OCR’s offer.
  19. OCR sent a Letter of Opportunity (LOO) to Shen Smiles on January 3, 2024.
  20. The LOO informed Shen Smiles that OCR’s investigation indicated that Shen Smiles failed to comply with the Privacy Rule, specifically 45 C.F.R. § 164.530(i)(1) and 164.530(c)(2)(i). The LOO stated that pursuant to 45 C.F.R. § 160.312(a)(3), OCR was informing Shen Smiles of the preliminary indications of noncompliance and providing Shen Smiles with an opportunity to submit written evidence of mitigating factors under 45 C.F.R. § 160.408 or affirmative defenses under 45 C.F.R. § 160.410 for OCR’s consideration in making a determination of a CMP pursuant to 45 C.F.R. § 160.404. The letter stated that Shen Smiles could also submit written evidence to support a waiver of a CMP for the indicated areas of noncompliance pursuant to 45 C.F.R. § 160.412. Each act of noncompliance under the Privacy Rule was described in the letter.
  21. Shen Smiles responded to the LOO by letter dated February 6, 2024.
  22. OCR determined that the information and arguments submitted by Shen Smiles in response to the LOO do not support an affirmative defense pursuant to 45 C.F.R. § 160.410. See Section IV below.
  23. OCR considered factors pursuant to 45 C.F.R. § 160.408, both based on evidence provided during the investigation and Shen Smile’s LOO response, in determining the amount of the CMP. See Section V below.
  24. OCR determined that the information and arguments submitted by Shen Smiles in its response to the LOO do not support a waiver of the CMP pursuant to 45 C.F.R. § 160.412. See Section VI below.
  25. OCR obtained the authorization of the Attorney General of the United States prior to issuing this Notice of Proposed Determination to impose a CMP, pursuant to 42 U.S.C. § 1320a-7a(c)(1).

III. Basis for CMP

Based on the above findings of fact, OCR has determined that Shen Smiles is liable for the following violations of the HIPAA Rules and, therefore, subject to a CMP.

1. Implement Policies and Procedures 45 C.F.R. § 164.530(i)(1)

Shen Smiles has not implemented policies and procedures with respect to protected health information that are designed to comply with both the Privacy Rule and the Breach Notification Rule requirements in violation of the Privacy Rule at 45 C.F.R. § 164.530(i)(1). The appropriate penalty tier for this violation is Reasonable Cause.

2. Safeguards 45 C.F.R. § 164.530(c)(2)(i)

Shen Smiles does not reasonably safeguard PHI from any intentional or unintentional use or disclosure in violation of the Privacy Rule at 45 C.F.R. § 164.530(c)(2)(i). The appropriate penalty tier for this violation is Reasonable Cause.

IV. No Affirmative Defenses

By its January 3, 2024, LOO, OCR offered Shen Smiles the opportunity to provide written evidence of affirmative defenses per 45 C.F.R. § 160.410. Shen Smiles respond by letter dated February 6, 2024. OCR determined that the information contained in Shen Smiles’ response did not provide a basis for an affirmative defense under 45 C.F.R. § 160.410.

Specifically, in its LOO response, Shen Smiles asserted that the Affirmative Defense at 45 C.F.R. § 160.410(c) applies, as the alleged violations are not due to willful neglect and were corrected during the 30-day period beginning on the first date that it knew, or, by exercising reasonable diligence, would have known that the violation occurred.

While OCR finds that the violations were not due to Willful Neglect, the evidence gathered during the investigation supports that the noncompliance has not been corrected within 30 days of discovery, and is in fact ongoing. Shen Smiles did not provide any evidence to support the application of this Affirmative Defense, specifically, evidence that the violations were corrected during the 30-day period beginning on the first date that Shen Smiles knew, or, by exercising reasonable diligence, would have known that the violations occurred.

V. Factors Considered in Determining the Amount of the CMP

In its February 6, 2024, letter to OCR responding to the LOO, Shen Smiles provided its position on mitigating factors. In accordance with § 160.408, OCR considered Shen Smiles’ response and the evidence obtained during its investigation in determining the amount of the CMP and has concluded that none of the factors should be applied as aggravating but has identified one factor to apply to mitigate the CMP.

OCR considered the factors as follows:

1. 45 C.F.R. § 160.408(a) The nature and extent of the violation.

Shen Smiles asserted in its response to the LOO that this matter relates only to a single incident and a single individual’s request for records.

While the underlying complaint alleged that one individual was affected with regard to a denial of their right to timely access their health records, OCR’s investigation found two longstanding (6 years) and ongoing (uncorrected) violations of the Privacy Rule. As such, OCR finds this is a neutral factor, with mitigating and aggravating considerations canceling each other out.

2. 45 C.F.R. § 160.408(b) The nature and extent of the harm resulting from the violation.

Shen Smiles asserts that the violation did not cause physical harm; that no financial harm has been proven by Complainant; there was no reputational harm; and that Shen Smiles does not know if the violation hindered an individual’s ability to obtain health care.

OCR’s investigation did not uncover evidence that Shen Smiles’ failure to implement policies and procedures and to safeguard PHI resulted in physical harm, financial harm, reputational harm, nor that it hindered an individual’s ability to obtain healthcare. However, as this good fortune cannot be attributed to any actions by Shen Smiles, OCR finds that this is neither an aggravating nor mitigating factor.

3. 45 C.F.R. § 160.408(c) The history of prior compliance with the administrative simplification provisions, including violations, by the covered entity.

Shen Smiles’ response to the LOO asserts that the current violation is not the same or similar to previous indications of noncompliance and no prior complaints have been made against Shen Smiles to OCR.

OCR has not previously investigated Shen Smiles regarding its compliance with the HIPAA Rules. As such, OCR has no record of any previous matters involving this entity that would demonstrate whether the current violation is the same or similar to previous indications of noncompliance, whether and to what extent the entity had attempted to correct previous indications of noncompliance, how the entity has responded to technical assistance from OCR provided in the context of a prior compliance effort, or how it responded to prior complaints.

However, the lack of previous investigations of Shen Smiles is not evidence of compliance with the HIPAA Rules. This is evident from OCR’s investigative finding that Shen Smiles did not meet its compliance obligations under the Privacy Rules for many years thus demonstrating a history of noncompliance.

Therefore, OCR finds that this is neither a mitigating nor aggravating factor.

4. 45 C.F.R. § 160.408(d) The financial condition of the covered entity.

Shen Smiles asserts in its LOO response that it did not have financial difficulties that affected its ability to comply with the HIPAA Rules, but that its noncompliance was “not intentional and was caused by the wrongful acts of third parties.”

OCR’s investigation did not reveal that Shen Smiles had financial difficulties that affected its ability to comply with the HIPAA Rules.

Shen Smiles asserted in its LOO response that the imposition of a civil money penalty would jeopardize its ability to continue to provide, or to pay for, health care. Shen Smiles stated in its LOO response that the imposition of the proposed civil money penalty would result in the complete financial failure of Shen Smiles’ business and would cause the loss of income and health benefits of all of the employees of the dental practice. Shen Smiles did not provide any evidence to support this assertion. Further, Shen Smiles did not provide a response to OCR’s previous requests for its financial records, and to date, has not provided such documentation. As a result, OCR does not have direct evidence of the financial condition of Shen Smiles.

However, OCR understands that Shen Smiles is a general dentistry solo practice in a rural area of Pennsylvania with 10 employees. Based on limited information gathered during the investigation, including publicly available information, OCR determined that Shen Smiles is a small entity. As such, OCR realizes that it is highly likely that the maximum potential CMP could substantially jeopardize this small entity’s ability to continue to provide health care. For this reason, OCR will reduce the proposed CMP by 90% based on the entity’s small size.

Based on the size of the entity alone, OCR will apply this as a mitigating factor.

5. 45 C.F.R. § 160.408(e) Such other matters as justice may require.

OCR did not find any other matters as justice requires. Therefore, OCR finds this is neither a mitigating nor aggravating factor.

VI. Waiver

By its January 3, 2024, LOO, OCR offered Shen Smiles the opportunity to provide written evidence supporting waiver of the proposed CMP amount. Shen Smiles, through legal counsel, responded by letter dated February 6, 2024. In the letter, Shen Smiles requested a waiver of the civil money penalty, in whole or in part, asserting that payment of the penalty would be excessive relative to the violation. Shen Smiles’ response did not provide a basis for the requested waiver. As such, OCR has determined that there is no basis for waiver of the proposed CMP amount as set forth at 45 C.F.R. § 160.412 because payment of the penalty is not excessive relative to the violation (see CMP calculations in Section VII).

VII. Amount of CMP

A. Amount of CMP Per Violation

OCR finds that Shen Smiles is liable for a CMP for violating the following requirements of the Privacy Rule:

(i) Implement Policies and Procedures (45 C.F.R. § 164.530(i)(1)). OCR will begin calculations for this proposed violation 6 years prior to the NPD date, October 1, 2018. The CMP amount is based on 45 C.F.R. § 160.404(b)(2)(ii)(A) [Reasonable Cause]. CMP: $700,000

Calendar Year 2018: 92 days from October 1, 2018 to December 31, 2018, at $1,379 per day = $126,868, with a yearly cap of $100,000

Calendar Year 2019: 365 days from January 1, 2019, to December 31, 2019, at $1,379 per day = $503,335 with a yearly cap of $100,000

Calendar Year 2020: 366 days from January 1, 2020, to December 31, 2020, at $1,379 per day = $504,714 with a yearly cap of $100,000

Calendar Year 2021: 365 days from January 1, 2021, to December 31, 2021, at $1,379 per day = $503,335 with a yearly cap of $100,000

Calendar Year 2022: 365 days from January 1, 2022, to December 31, 2022, at $1,379 per day = $503,335 with a yearly cap of $100,000

Calendar Year 2023: 365 days from January 1, 2023, to December 31, 2023, at $1,379 per day = $503,335 with a yearly cap of $100,000

Calendar Year 2024: 213 days from January 1, 2024, to July 31, 2024, at $1,379 per day = $293,727 with a yearly cap of $100,000

(ii) Safeguards (45 C.F.R. § 164.530(c)(2)(i)). OCR will begin calculations for this proposed violation 6 years prior to the NPD date, October 1, 2018. The CMP amount is based on 45 C.F.R. § 160.404(b)(2)(ii)(A) [Reasonable Cause]. CMP: $700,000

Calendar Year 2018: 92 days from October 1, 2018, to December 31, 2018, at $1,379 per day = $126,868, with a yearly cap of $100,000

Calendar Year 2019: 365 days from January 1, 2019, to December 31, 2019, at $1,379 per day = $503,335 with a yearly cap of $100,000

Calendar Year 2020: 366 days from January 1, 2020, to December 31, 2020, at $1,379 per day = $504,714 with a yearly cap of $100,000

Calendar Year 2021: 365 days from January 1, 2021, to December 31, 2021, at $1,379 per day = $503,335 with a yearly cap of $100,000

Calendar Year 2022: 365 days from January 1, 2022, to December 31, 2022, at $1,379 per day = $503,335 with a yearly cap of $100,000

Calendar Year 2023: 365 days from January 1, 2023, to December 31, 2023, at $1,379 per day = $503,335 with a yearly cap of $100,000

Calendar Year 2024: 213 days from January 1, 2024, to July 31, 2024, at $1,379 per day = $293,727 with a yearly cap of $100,000

B. Total Amount of CMP

Maximum Potential CMP (unmitigated): $1,400,000

As described above, OCR did not identify any aggravating factors that merit calculating CMPs for the potential violations at a daily amount higher than the minimum under Reasonable Cause. However, considering the presumed size of Shen Smiles’ business, and its location in rural Pennsylvania, to avoid the alleged complete financial failure of Shen Smiles and concomitant loss of a health care provider in a rural area of Pennsylvania, OCR determined that a 90% reduction of the CMP from $1,400,000 to $140,000 is an appropriate CMP in this case.

CMP Total (mitigated): $140,000

VIII. Right to a Hearing

Shen Smiles has the right to a hearing before an administrative law judge to challenge the proposed CMP. To request a hearing to challenge the proposed CMP, Shen Smiles must mail a request, via certified mail with return receipt requested, under the procedures set forth at 45 C.F.R. Part 160 within 90 days of your receipt of this letter. Such a request must: (1) clearly and directly admit, deny, or explain each of the findings of fact contained in this notice; and (2) state the circumstances or arguments that you allege constitute the grounds for any defense, and the factual and legal basis for opposing the proposed CMP. See 45 C.F.R. § 160.504(c). If you wish to request a hearing, you must submit your request to:

U.S. Department of Health & Human Services
Departmental Appeals Board, MS 6132
Civil Remedies Division
330 Independence Ave, SW
Cohen Building, Room G-644
Washington, D.C. 20201
Telephone: ███████

Copy to:
Emily Crabbe, Senior Advisor of HIPDC Compliance
And Enforcement
U. S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue, SW
Room 509F, HHH Building
Washington, D.C. 20201

A failure to request a hearing within 90 days permits the imposition of the proposed CMP without a right to a hearing under 45 C.F.R. § 160.504 or a right of appeal under 45 C.F.R. § 160.548. If you choose not to contest this proposed CMP, you should submit a written statement accepting its imposition within 90 days of receipt of this notice.

If Shen Smiles does not request a hearing within 90 days, then OCR will notify Shen Smiles of the imposition of the CMP through a separate letter, including instructions on how to make payment, and the CMP will become final upon receipt of such notice.

If you have questions, you may contact Ms. Crabbe at ███████ or via email at ███████.

Sincerely,

/s/

Jamie Rahn Ballay
Regional Manager

Enclosure: CMP Chart

Footnotes

1 The CMPs reflect the penalty tiers described in the Notification of Enforcement Discretion (April 30, 2019). See https://www.federalregister.gov/documents/2019/04/30/2019-08530/notification-of-enforcement-discretion-regarding-hipaa-civil-money-penalties.

2 For violations occurring on or after November 3, 2015, HHS may make annual adjustments to the CMP amounts pursuant to the Federal Civil Penalties Inflation Adjustment Act Improvement Act of 2015. The annual inflation amounts are found at 45 C.F.R. §102.3.

3 See Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015, Sec. 701 of Public Law 114-74. Current inflation amounts are available at 45 CFR § 102.3.

4 See 42 U.S.C. § 1320a-7a(c)(1); 45 C.F.R. § 160.414.

5 45 C.F.R. § 164.530 (c).

6 45 C.F.R. § 164.530 (i)(1).

7 45 C.F.R. § 164.530 (j).

8 45 C.F.R. § 164.400, et seq.

9 Designated record set means: (1) A group of records maintained by or for a covered entity that is: (i) The medical records and billing records about individuals maintained by or for a covered health care provider; (ii) The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or (iii) Used, in whole or in part, by or for the covered entity to make decisions about individuals. (2) For purposes of this paragraph, the term record means any item, collection, or grouping of information that includes protected health information and is maintained, collected, used, or disseminated by or for a covered entity. 45 C.F.R §164.501.

10 45 C.F.R. § 164.524(a).

11 OCR has accepted the sworn statements of Dr. Shen that are contained in the Affidavit as true, and that Affected Party’s dental records are not in Shen Smiles’ possession with the exception of the “Single Family Ledger.” Because the right of access under the Privacy Rule requires the production of PHI as long as it is maintained in the designated record set, OCR did not pursue an access violation against Shen Smiles.

Content last reviewed