WASHINGTON – The U.S. Department of Health and Human Services' (HHS) Office for Civil Rights (OCR) has fined Cignet Health of Prince George's County, Md., $4.3 million, in what officials say is the first civil money penalty (CMP) issued for a covered entity's violations of the HIPAA Privacy Rule.

In a Notice of Proposed Determination issued Oct. 20, 2010, OCR found that Cignet violated 41 patients' rights by denying them access to their medical records when requested between September 2008 and October 2009.

According to officials, these patients individually filed complaints with OCR, initiating investigations of each complaint. The HIPAA Privacy Rule requires that a covered entity provide a patient with a copy of their medical records within 30 (and no later than 60) days of the patient's request. The CMP for these violations is $1.3 million.