This time it was David Mente’s turn.

Mente, a licensed professional counselor in Pittsburgh is the 44th individual or organization to face an enforcement action by the HHS Office for Civil Rights (OCR) for allegedly violating the right of access under the Privacy Rule. He joins hospitals, dentists, a podiatrist, a lab and a number of others in his field who’ve also felt OCR’s wrath on this issue.

Although Mente’s settlement was announced last month, it was reached at the end of 2022, according to documents OCR released.^[1] In May, OCR also disclosed a $350,000 settlement with a revenue cycle and practice management firm that had improperly disclosed protected health information (PHI) in 2018.^[2]

The settlement with Mente, who initially responded to RPP’s request for comment but then did not follow through, also drives home lessons for covered entities and business associates that don’t want to find themselves in a similar situation—namely, don’t generate multiple complaints to OCR and don’t withhold records from patients’ relatives, particularly in situations where a parent requests a child’s information. But it also shows the complexities of access requests that involve mental health.

In addition to paying $15,000 and implementing a two-year corrective action plan (CAP), Mente agreed to provide the records to a father of three minor children; apparently, he still had not released them at the time of the settlement. The terms required him to provide the records within 15 days of signing the agreement. The date adjoining a space for his signature on the agreement is Dec. 29, 2022. An OCR official apparently signed on Jan. 5 of this year.