Concentra Settlement Agreement

1 DEPARTMENT OF HEALTH AND HUMAN SERVICES DEPARTMENTAL APPEALS BOARD CIVIL REMEDIES DIVISION Secretary, U.S. Department of Health and Human Services, Petitioner, v. Concentra Inc., Respondent. Docket No. C-21-1106 Administrative Law Judge Kourtney LeBlanc SETTLEMENT AGREEMENT This Settlement Agreement (“Agreement”) is entered into between the United States Department of Health and Human Services, Office for Civil Rights (“OCR”) and Concentra Inc., its wholly-owned and managed affiliates, subsidiaries and parent entities (“Concentra”) (collectively, “the Parties”), acting through their duly authorized representatives, to resolve this case prior to an administrative hearing pursuant to 45 C.F.R. § 160.514. I. RELEVANT BACKGROUND 1. OCR enforces the Federal standards that govern the privacy of individually identifiable health information (45 C.F.R. Part 160 and Subparts A and E of Part 164, the “Privacy Rule”), the Federal standards that govern the security of electronic individually identifiable health information (45 C.F.R. Part 160 and Subparts A and C of Part 164, the “Security Rule”), and the Federal standards for notification in the case of breach of unsecured protected health information (45 C.F.R. Part 160 and Subparts A and D of 45 C.F.R. Part 164, the “Breach Notification Rule”). OCR has the authority to conduct compliance reviews and investigations of complaints alleging violations of the Privacy, Security, and Breach Notification Rules (collectively the “HIPAA Rules”) by covered entities and business associates, and covered entities and business associates must cooperate with OCR compliance reviews and complaint investigations. See 45 C.F.R. §§ 160.306(c), 160.308, and 160.310(b). 2. Concentra is a “covered entity” under 45 C.F.R. § 160.103 and therefore is required to comply with the HIPAA Rules. 2 3. Under the HIPAA Privacy Rule, an individual has a right of access to inspect and obtain a copy of protected health information (“PHI”) about the individual in a designated record set for as long as the PHI is maintained by a covered entity in the designated record set. 45 C.F.R. § 164.524(a). A covered entity must act on a request for access no later than 30 days after receipt of the request. 45 C.F.R. § 164.524(b). 4. On December 28, 2018, HHS received a complaint against Concentra alleging that Concentra had failed to respond appropriately to requests for a patient’s medical records. 5. OCR’s investigation revealed that, on February 15, 2018, a request was sent to Concentra’s Peoria, Arizona Center asking for an electronic copy of medical and billing records. Upon receipt of that request, an employee at Concentra’s Peoria Center sent the access request to Concentra’s Central Billing Office (“CBO”). Virtually identical follow-up requests were sent to Concentra’s Peoria, Arizona Center and Concentra’s CBO several more times in 2018. 6. OCR’s investigation further revealed that, on October 8, 2018, Concentra’s business associate sent an invoice for $82.57 for a copy of the medical records. That demand amount was disputed, and on March 21, 2019, the business associate adjusted the balance due to $6.50 and mailed a copy of the records in paper format. 7. By letter dated July 30, 2020, OCR notified Concentra that OCR found preliminary indications of noncompliance with the Privacy Rule’s right of access standard (45 C.F.R. § 164.524(b)) requiring a covered entity to act on a request for access to PHI no later than 30 days after receipt of the request. The letter additionally notified Concentra of the opportunity to submit for OCR’s consideration written evidence of any mitigating factors, affirmative defenses, or to support a waiver of a civil money penalty (“CMP”). On September 8, 2020, Concentra responded to that letter disputing the preliminary indications of noncompliance with the Privacy Rule’s right of access standard and submitting evidence in support of its position. 8. By letter dated June 29, 2021, OCR notified Concentra that OCR was proposing to impose a CMP in the amount of $250,000 for failing to comply with the right of access standard at 45 C.F.R. § 164.524(b). 9. On September 16, 2021, Concentra requested a hearing before an Administrative Law Judge to contest OCR’s imposition of the CMP, and the matter was docketed before the Civil Remedies Division of the Departmental Appeals Board (“DAB”) of the United States Department of Health and Human Services as Docket No. C-21-1106. 3 10. On September 8, 2022, Respondent moved for summary judgment, and in Ruling No. 2025-6, dated January 3, 2025, the ALJ denied that motion, determining that factual disputes remained regarding issues between Respondent and OCR. II. SETTLEMENT TERMS AND CONDITIONS Respondent and OCR have engaged in settlement negotiations and agreed to resolve this case prior to an administrative hearing. In consideration of the mutual understanding in settlement of this matter and subject only to the conditions contained herein, the Parties agree as follows: 1. As a compromise based on the unique facts and circumstances of this matter, Concentra agrees to pay, and OCR agrees to accept, the amount of $112,500 (“Settlement Amount”) to settle in full the dispute between the parties as to the CMP proposed in OCR’s letter dated June 29, 2021. Concentra agrees to pay the Settlement Amount within three (3) business days of the Effective Date by the electronic transfer of funds to OCR via the Pay.gov portal in accordance with the Civil Money Penalty Payment Instructions that OCR provided with this Agreement. OCR will send an e-invoice with payment instructions to Su Zan Nelson, Executive Vice President, Chief Accounting Officer for Concentra, via electronic mail to REDACTED. Within three (3) business days of the Effective Date, Concentra shall also provide to OCR documentation of Concentra’s EIN/TIN; a screenshot is sufficient. 2. Concentra agrees to withdraw, pursuant to 45 C.F.R. § 160.504(d)(2), its request for a hearing in the case docketed as DAB Docket No. C-21-1106 within three (3) business days of the Effective Date of this Agreement. 3. The Parties are entering into this Agreement in the interest of avoiding the time and cost of further litigation. Nothing in this Agreement should be construed as an admission of any wrongdoing or liability or a concession of the positions taken by either party. 4. The Agreement shall become effective (i.e., final and binding) upon the date of signing of this Agreement by the last signatory (“Effective Date”). 5. This Agreement is binding on Concentra and its successors, heirs, transferees, and assigns. 6. Each Party to this Agreement shall bear its own legal and other costs incurred in connection with this matter, including the preparation and performance of this Agreement. 7. This Agreement is exclusively intended to settle the case docketed at C-21-1106, and 4 this Agreement does not constitute a waiver of any other rights or remedies available to the United States, HHS, OCR, or Concentra that are not expressly stated in this Agreement. 8. OCR does not release Concentra from, nor waive any rights, obligations, or causes of action other than those arising out of or related to this Agreement. 9. This Agreement is intended to be for the benefit of the Parties only, and by this instrument the Parties do not release any claims against or by any other person or entity. 10. This Agreement constitutes the complete agreement between the Parties. All material representations, understandings, and promises of the Parties are contained in this Agreement. Any modifications to this Agreement shall be set forth in writing and signed by all Parties. 11. No restriction is placed on the publication of this Agreement. OCR may be required to disclose material related to this Agreement to any person upon request consistent with the applicable provisions of the Freedom of Information Act, 5 U.S.C. § 552, and its implementing regulations, 45 C.F.R. Part 5. However, such material may be subject to exceptions at 5 U.S.C. § 552(b)(4) and 45 C.F.R. § 5.31. 12. This Agreement may be executed in counterparts, each of which constitutes an original, and all of which shall constitute one and the same agreement. Electronic or PDF signatures will be valid and enforceable in lieu of handwritten signatures. 13. The individual(s) signing this Agreement on behalf of Concentra represents and warrants that they are authorized to execute this Agreement and bind Concentra. The individual(s) signing this Agreement on behalf of OCR represents and warrants that they are signing this Agreement in their official capacity and that they are authorized to execute this Agreement. [SIGNATURES ON NEXT PAGE] 5 Dated the 5th day of May, 2025. For Concentra Inc.: For the United States Department of Health and Human Services, Office for Civil Rights: __/s/___________April 30, 2025___ Tim Addison Chief Legal Counsel Concentra Inc. 5080 Spectrum Drive Suite 1200W Addison, Texas 75001 _/s/ Marisa M. Smith, Deputy Director, Enforcement, for_ Barbara Stampul Regional Manager Office for Civil Rights U.S. Department of Health and Human Services Sam Nunn Atlanta Federal Center Suite 16T70 61 Forsyth Street, S.W. Atlanta, GA 30303-8909 (800) 368-1019