Topics on this page: Notice of Proposed Determination | Notice of Final Determination
Notice of Proposed Determination
October 22, 2020
Via Personal Service and Certified Mail Return Receipt Requested
Dr. Robert Glaser
2800 Marcus Avenue, Ste. 203
New Hyde Park, NY 11550
Re: Office of Dr. Robert Glaser
OCR Transaction Number: 18-300054
Notice of Proposed Determination
Dear Dr. Glaser:
Pursuant to the authority delegated by the Secretary of the United States Department of Health and Human Services (HHS) to the Office for Civil Rights (OCR), I am writing to inform you that OCR is proposing to impose a civil money penalty (CMP) of $100,000 against the Office of Dr. Robert Glaser (Dr. Glaser).
This proposed action is being taken under the regulations promulgated by the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), § 262(a), Pub.L. 104-191, 110 Stat. 1936, as amended by the Health Information Technology for Economic and Clinical Health ("HITECH") Act, Public Law 111-5, Section 13410, codified at 42 U.S.C. § 1320d-5, and under 45 C.F.R. Part 1600, Subpart D.
I. The Statutory Basis for the Proposed CMP
The Secretary of HHS is authorized to impose a CMP (subject to the limitations set forth at 42 U.S.C. § 1320d-5(b)) against any covered entity, as described at 42 U.S.C. § 1320d-1(a), that violates a provision of Part C (Administrative Simplification) of Title XI of the Social Security Act. See HIPAA, § 262(a), as amended, 42 U.S.C. § 1320d-5(a). This authority includes violations of the applicable provisions of the Federal Standards for Privacy of Individually Identifiable Health Information and the Security Standards for the Protection of Electronic Protected Health Information (45 C.F.R. Parts 160 and 164, Subparts A, C, and E, the Privacy and Security Rules), and the Breach Notification Rule (45 C.F.R. Parts 160 and 164, Subpart D), pursuant to Section 264(c) of HIPAA. The Secretary has delegated enforcement responsibility for the HIPAA Rules to the Director of OCR. See 65 Fed. Reg. 82,381 (Dec. 28, 2000) and 74 Fed. Reg. 38630 (July 27, 2009). The Secretary is authorized under the HITECH Act § 13410, 42 U.S.C. § 1320d-5(a)(3), to impose CMPs for violations occurring on or after February 18, 2009, of:
- A minimum of $100 for each violation where the covered entity or business associate did not know and, by exercising reasonable diligence, would not have known that the covered entity or business associate violated such provision, except that the total amount imposed on the covered entity or business associate for all violations of an identical requirement or prohibition during a calendar year may not exceed $25,000.
- A minimum of $1,000 for each violation due to reasonable cause and not to willful neglect, except that the total amount imposed on the covered entity or business associate for all violations of an identical requirement or prohibition during a calendar year may not exceed $100,000. Reasonable cause means an act or omission in which a covered entity or business associate knew, or by exercising reasonable diligence would have known, that the act or omission violated an administrative simplification provision, but in which the covered entity or business associate did not act with willful neglect.
- A minimum of $10,000 for each violation due to willful neglect and corrected within 30 days, except that the total amount imposed on the covered entity or business associate for all violations of an identical requirement or prohibition during a calendar year may not exceed $250,000.
- A minimum of $50,000 for each violation due to willful neglect and uncorrected within 30 days, except that the total amount imposed on the covered entity or business associate for all violations of an identical requirement or prohibition during a calendar year may not exceed $1,500,000.
- As required by law, OCR has adjusted the CMP ranges for each penalty tier for inflation.1 The adjusted amounts are applicable only to CMPs whose violations occurred after November 2, 2015.
OCR is precluded from imposing a CMP unless the action is commenced within six years from the date of the violation.2
II. Findings of Fact
- Dr. Glaser is a "covered entity" within the definition set forth at 45 C.F.R. § 160.103, and, as such, is required to comply with the requirements of the Privacy, Security, and Breach Notification Rules.
- Dr. Glaser is a solo practitioner specializing in Cardiovascular Disease and Internal Medicine.
- Dr. Glaser creates, maintains, receives, and transmits protected health information (PHI) related to patients who receive health care services from its office.
- On November 9, 2017, the Complainant, a former patient of Dr. Glaser, filed a complaint alleging that Dr. Glaser failed to respond to several written and verbal requests he made for access to his medical records from 2013 to 2014. On December 15, 2017, OCR closed the complaint, but advised Dr. Glaser by letter to assess the Complainant's allegations and determine whether there may have been any noncompliance with Privacy Rule requirement regarding the Complainant's record request. OCR also encouraged Dr. Glaser to provide the requested record access if the requests met the requirements of the Rule.
- On March 20, 2018, OCR received a second complaint from the Complainant, alleging that Dr. Glaser still had not provided him with copies of his medical records. The Complainant explained that he made several verbal requests for his medical records and his current physician sent several written requests to Dr. Glaser's office. The Complainant provided OCR copies of three written requests for the records submitted by his current physician dated May 28, 2017, June 28, 2017, and January 15, 2018.
- By letter dated August 15, 2018, OCR notified Dr. Glaser that it was initiating an investigation of Complainant's March 20, 2018 complaint and directed that he provide several data items. These included a written response to the Complainant's allegations; a copy of his office policies and procedures with respect to individuals' access to PHI; a copy of his notice of privacy practice; and documentary assurance that workforce members were provided with training on his policies and procedures regarding individuals' access to PHI. The letter directed Dr. Glaser to respond to OCR's requests were within fourteen (14) calendar days.
- The August 15, 2018, letter informed Dr. Glaser of an individual's general right to access his or her medical records under the Privacy Rule (45 CFR § 164.524(a)(1)). Under the Privacy Rule, Dr. Glaser is obligated to provide access to patient medical records no later than 60 days after receiving a patient's request.
- The August 15, 2018, letter also advised Dr. Glaser of his legal obligation to cooperate with OCR's complaint investigation and OCR's authority to collect information and ascertain a Covered Entity's compliance with the Privacy Rule (45 CFR §§ 160.300 - 160.316).
- On August 21, 2018, OCR contacted Dr. Glaser by phone to inquire about the status of his response to the August 15, 2018 letter. Dr. Glaser's office manager advised OCR that Dr. Glaser had not received the letter. OCR re-sent the data request letter that day via fax. Dr. Glaser did not respond to the letter.
- Having not received a response to its data request, OCR contacted Dr. Glaser by phone on September 4, 2018. OCR spoke directly with Dr. Glaser, who requested an extension due to the religious holiday. OCR granted Dr. Glaser an extension to provide the data until September 13, 2018. However, Dr. Glaser did not provide a response.
- On September 27, 2018, OCR called Dr. Glaser's office to inquire about the overdue response to the August 15, 2018 letter. Dr. Glaser's office manager advised OCR that she did not know the status of Dr. Glaser's response and that Dr. Glaser was unable to speak with OCR.
- OCR sent Dr. Glaser a letter via fax and regular mail on December 7, 2018, reminding him of his obligation to respond to OCR's inquiries, along with the original data request items identified in the August 15, 2018 letter. Dr. Glaser did not respond to this letter.
- Due to Dr. Glaser's repeated failure to respond to OCR, on April 5, 2019, OCR sent the doctor a letter, via fax and certified mail with return receipt, containing the original August 15, 2018 data request items, along with a request for a summary of steps taken to investigate and address the complainant's allegations; a copy of his most recent quarterly balance sheet, income statement, and cash flows as well most recent full year audited financial statements (including notes) prepared, reviewed, or audited by an independent accounting firm; a copy of his most recent federal tax return; any additional financial information believed to be relevant; and any additional material he would like us to consider in determining his compliance status. Again, Dr. Glaser did not respond.
- On September 13, 2019, OCR sent Dr. Glaser a letter via fax and certified mail with return receipt, informing him that OCR concluded it investigation. The letter contained a proposed Resolution Agreement (RA) and Corrective Action Plan (CAP). OCR gave Dr. Glaser ten (10) days to return the signed RA and CAP.
- On September 18, 2019, Dr. Glaser's office manager contacted the OCR Regional Manager. The OCR Regional Manager advised the office manager that OCR had determined that Dr. Glaser denied the patient access to his medical records and failed to cooperate with OCR's investigation. The OCR Regional Manager further advised the office manager that Dr. Glaser could voluntarily resolve the matter by signing the RA and CAP and paying the resolution amount. The officer manager stated that she would advise Dr. Glaser of her call with the OCR Regional Manager.
- Dr. Glaser did not respond to OCR's September 13, 2019, letter.
- OCR issued a Letter of Opportunity on November 4, 2019, via fax and certified mail with return receipt, informing Dr. Glaser that OCR's investigation found that he failed to comply with the Privacy Rule and that the matter had not been resolved by informal means despite OCR's attempts to do so. The letter stated that, pursuant to 45 C.F.R. § 160.312(a)(3), OCR was informing Dr. Glaser of the preliminary indications of non-compliance and providing him with an opportunity to submit written evidence of mitigating factors under 45 C.F.R. § 160.408 or affirmative defenses under 45 C.F.R. § 160.410 for OCR's consideration in making a determination of a CMP pursuant to 45 C.F.R. § 160.404. The letter stated that Dr. Glaser could also submit written evidence to support a waiver of a CMP for the indicated areas of non-compliance. Each act of noncompliance was described in the letter.
- According to United States Postal Service records, the Letter of Opportunity was received and signed for by Dr. Glaser's office manager on November 7, 2019.
- Dr. Glaser did not respond to the Letter of Opportunity, and therefore has not provided any written evidence of mitigating factors under 45 C.F.R. § 160.408 or affirmative defenses under 45 C.F.R. § 160.410 for OCR's consideration in making a determination of a CMP pursuant to 45 C.F.R. § 160.404. Dr. Glaser also did not submit any written evidence to support a waiver of a CMP for the indicated areas of non-compliance.
- OCR obtained the authorization of the Attorney General of the United States prior to issuing this Notice of Proposed Determination to impose a CMP.
III. Basis for CMP
Based on the above findings of fact, OCR has determined that Dr. Glaser is liable for the following violation of the HIPAA Rules and, therefore, is subject to a CMP.
1. Dr. Glaser failed to provide access to medical records in response to a lawful request for such records from its patient, in violation of 45 CFR § 164.524(a)(1). The appropriate penalty tier for this continuing violation from February 13, 2018, to October 22, 2020, is willful neglect.
IV. No Affirmative Defenses
By its November 4, 2019, Letter of Opportunity, OCR offered Dr. Glaser the opportunity to provide written evidence of affirmative defenses within thirty (30) days from the date of that letter. Dr. Glaser did not respond, and therefore did not submit any affirmative defenses under 45 C.F.R. § 160.410 for OCR's consideration in making a determination of a CMP pursuant to 45 C.F.R. § 160.404.
V. Factors Considered in Determining the Amount of the CMP
In determining the amount of the CMP, OCR considered the following factors in accordance with 45 C.F.R. § 160.408.3
- OCR considered the nature and extent of the violations. Dr. Glaser failed to comply with the patient's requests for access to his medical records over a period of several years. Dr. Glaser also failed to respond to OCR's August 15, 2018 data request and follow-up requests for information needed to complete OCR's investigation.
- OCR considered Dr. Glaser's history of compliance. This action stems from the investigation of the patient's second complaint alleging Dr. Glaser failed to provide access to medical records. Dr. Glaser does not have not a prior history of noncompliance with OCR.
- OCR considered Dr. Glaser's financial condition. OCR is cognizant of Dr. Glaser's status as a sole medical practitioner; however, Dr. Glaser's failure to cooperate with OCR's investigation has left OCR without direct knowledge of Dr. Glaser's finances.
- By its Letter of Opportunity, OCR offered Dr. Glaser the opportunity to provide written evidence of mitigating factors within thirty (30) days from the date of that letter. Dr. Glaser failed to respond.
By failing to provide the patient with his medical records, the violation indicated above—right of access—is considered to be an ongoing violation until the date cured. For violations of 45 C.F.R. §164.524 that occurred during the period from February 13, 2018, to the present date, October 22, 2020, OCR proposes that the daily penalty amount of $59,522 per day be applied for these violations that were due to willful neglect under 45 C.F.R. § 160.404(b)(2)(iv)(A). This is the lowest amount in the willful neglect tier applied for each violation.
While Dr. Glaser has provided no evidence in response to OCR's requests for evidence of mitigating factors, OCR has learned through public information that Dr. Glaser is a solo practitioner located in New Hyde Park, NY. The imposition of the maximum CMP would likely impact the ability of Dr. Glaser to provide care to his community. Therefore, using the discretion as contemplated by 45 CFR 160.408 (d) and (e), the CMP amount is $100,000.
VI. Amount of CMP
Based on OCR's evaluation of the factors listed in 45 C.F.R. § 160.408, OCR finds Dr. Glaser is liable, with regard to the violation described in Section III:
1. Right of Access (45 CFR § 164.524(a)(1)): The CMP is $100,000 (see attached chart). This CMP amount is based on 45 CFR § 160.404(b)(2)(iv).
VII. Right to a Hearing
Dr. Glaser has the right to a hearing before an administrative law judge to challenge these proposed CMPs. To request a hearing to challenge these proposed CMPs, Dr. Glaser must mail a request, via certified mail with return receipt request, under the procedures set forth at 45 C.F.R. Part 160 within 90 days of your receipt of this letter. Such a request must: (1) clearly and directly admit, deny, or explain each of the findings of fact contained in this notice; and (2) state the circumstances or arguments that you allege constitute the grounds for any defense, and the factual and legal basis for opposing the proposed CMPs. See 45 C.F.R. § 160.504(c). If you wish to request a hearing, you must submit your request to:
Department of Health & Human Services
Departmental Appeals Board, MS 6132
Civil Remedies Division
330 Independence Ave, SW
Cohen Building, Room G-644
Washington, D.C. 20201
Telephone: (202) 565-9462
Copy to:
Serena Mosley-Day, Senior Advisor
Office for Civil Rights
200 Independence Avenue, SW
Suite 523E
Hubert H. Humphrey Building
Washington, D.C. 20201
Telephone: (404) 562-7864
A failure to request a hearing within 90 days permits the imposition of the proposed CMPs without a right to a hearing under 45 C.F.R. § 160.504 or a right of appeal under 45 C.F.R. § 160.548. If you choose not to contest this proposed CMP, you should submit a written statement accepting its imposition within 90 days of receipt of this notice.
If Dr. Glaser does not request a hearing within 90 days, then OCR will notify Dr. Glaser of the imposition of the CMPs through a separate letter, including instructions on how to make payment and the CMPs will become final upon receipt of such notice.
If you have any questions, you may contact me at (212) 264-4136 or [email protected].
Sincerely,
Linda C. Colֶón
Regional Manager
Enclosure: CMP Penalty Chart
Notice of Final Determination
May 21, 2021
Via Certified Mail, Return Receipt Requested
Dr. Robert Glaser
2800 Marcus Avenue, Ste. 203
New Hyde Park, NY 11550
Re: Our Reference Number: 18-300054
Notice of Final Determination
Dear Dr. Glaser:
Pursuant to the authority delegated by the Secretary of the United States Department of Health
and Human Services (HHS) to the Director of the Office for Civil Rights (OCR), I am writing to
inform you that the civil money penalty (CMP) of $100,000.00 against the Office of Dr. Robert Glaser (hereafter referred to as "Dr. Glaser") is final. This letter also contains instructions for Dr. Glaser to make payment of the CMP amount.
I. Dr. Glaser's Failure to Request a Hearing
By letter dated October 22, 2020, OCR issued Dr. Glaser a Notice of Proposed Determination (attached hereto), informing him that OCR was proposing to impose a CMP in the amount of $100,000.00 based on the findings of noncompliance specified in the letter. The Notice of Proposed Determination stated that Dr. Glaser had a right to request a hearing on the proposed CMP within ninety (90) days of the date of receipt of the letter and provided instructions on requesting a hearing with the Departmental Appeals Board. The Notice of Proposed Determination further advised that failure to request a hearing within this time period could result in the imposition of the proposed CMP without a hearing under 45 C.F.R. § 160.504 or the right of appeal under 45 C.F.R. § 160.548. Dr. Glaser received the Notice of Proposed Determination on October 24, 2020, when it was delivered by certified mail, return receipt requested, and on October 26, 2020, when it was delivered by a duly registered process server on Dr. Glaser's Administrative Assistant, Rasheem Martin, Jr., who confirmed he was expressly authorized to accept process for Dr. Glaser. Dr. Glaser failed to file a timely request for a hearing in accordance with the instruction in the Notice of Proposed Determination.
II. No Right of Appeal
Dr. Glaser has no right to appeal the imposition of the CMP under 45 C.F.R. § 160.548 since
Dr. Glaser failed to timely request a hearing.
III. Instructions for Payment of the CMP Amount
Payment of the full and aggregate amount of $100,000.00 is due upon Dr. Glaser's receipt of this Notice of Final Determination. Payment can be made in accordance with the instructions on Exhibit 1 to this Notice.
IV. Consequences of Nonpayment
In the event that payment is not received upon Dr. Glaser's receipt of this Notice of Final Determination, the amount of the penalty may be deducted from any sum then or later owing by the United States or by a State agency, and a civil action may be brought in the United States District Court to recover the amount of the penalty.
V. The Legal Basis for This Action
This action is being taken under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), § 262(a), Pub.L. 104-191, 110 Stat. 1936, as amended, codified at 42 U.S.C. § 1320d-5, and under the enforcement regulations at 45 C.F.R. Part 160, subpart D. The Secretary of HHS is authorized to impose CMPs (subject to the limitations at 42 U.S.C. § 1320d-5(b)) against any covered entity, as described at 42 U.S.C. § 1320d-l(a), that violates a provision of Part C (Administrative Simplification) of Title XI of the Social Security Act. See 42 U.S.C. § 1320d- 5(a), as amended. This authority extends to violations of the regulations commonly known as the Privacy Rule promulgated at 45 C.F.R. Part 160 and subparts A and E of Part 164, pursuant to Section 264(c) of HIPAA. The Secretary has delegated enforcement responsibility for the Privacy Rule to the Director of OCR. See Office for Civil Rights; Statement of Delegation of Authority, 65 Fed. Reg. 82381 (Dec. 28, 2000).
If you have any questions concerning this letter, please contact Linda C. Colón, Regional Manager, OCR, Eastern and Caribbean Region, at (212) 264-4136.
Sincerely,
Robinsue Frohboese
Acting Director and Principal Deputy Director
Office for Civil Rights
U.S. Department of Health and Human Services
Enclosed:
Exhibit 1 – Payment Instructions
Attachment – Notice of Proposed Determination
- 1. See Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015, Sec. 701 of Public Law 114-74.
- 2. 45 C.F.R. § 160.104
- 3. 45 C.F.R. §160.408 Factors considered in determining the amount of a civil money penalty. In determining the amount of any civil money penalty, the Secretary will consider the following factors, which may be mitigating or aggravating as appropriate: (a) The nature and extent of the violation; (b) The nature and extent of the harm resulting from the violation; (c) The history of prior compliance with the administrative simplification provisions; (d) The financial condition of the covered entity; and (e) Such other matters as justice may require.
