An Arizona long-term care provider facing a quarter-million-dollar penalty for alleged HIPAA infractions converted that judgment into a settlement for just one-seventh that amount after a diligent defense of its operations and resources.
The agreement required Phoenix Healthcare to pay $35,000 in civil monetary penalties and revise its HIPAA policies and training, without conceding any improprieties. The outcome could have been much worse for the operator.
The Department of Health and Human Services on Friday announced it had settled a Health Insurance Portability and Accountability Act investigation into Phoenix. Originally it sought CMP worth $250,000.
Tulsa, OK-based Phoenix Healthcare operates six care facilities, including Green County Care Center, which provides long-term care in that area.
In 2019, a resident’s family member requested a copy of the resident’s medical records. She alleged that Phoenix would not provide her with the records and delayed their delivery for nearly a year, according to a HHS report.
HHS’ Office for Civil Rights notified Phoenix of its intent to issue a $250,000 CMP for that incident in March 2021. A series of appeals before administrative law judges and appeals boards whittled down that penalty over the next several years.
The most recent decision in August 2023 upheld OCR’s claim that Phoenix had been willfully neglectful of HIPAA rules. But by that point, the total CMP had been lowered to $75,000.
Documented claims of substantial financial challenges from Phoenix, however, successfully prompted a settlement for far less than half of that total — $35,000.
“The Parties are entering into this Agreement in consideration of Phoenix’s claims of financial hardship and documents submitted in support thereof as well as to avoid the time and cost of further litigation,” explained the settlement agreement. “Nothing in this Agreement should be construed as an admission of liability or concession of the position taken by either party.”
Phoenix did not respond to McKnight’s request for comment by publication deadline Friday.
Beyond the required financial payment, Phoenix also was required to update its HIPAA-related procedures, perform new training for all employees and certify with HHS that these steps had been taken to the government’s satisfaction.
The settlement shows that even in the current heightened regulatory environment, diligent appeals by providers can make a difference, observers said.
Phoenix agreed to pay the settlement amount on Oct. 13, 2023, but HHS issued a notice about it, and subsequent compliance actions by the operator, only on Friday.
CMPs will continue to be a hot-button issue in long-term care. Last week, the Centers for Medicare & Medicaid Services proposed a rule that would expand that agency’s power to impose more frequent and more costly CMPs on providers.
