Federal officials ordered a health clinic in Prince George's County to pay a $4.3 million penalty for failing to provide medical records to dozens of patients and for failing to cooperate with a subsequent government investigation.

The U.S. Department of Health and Human Services' Office for Civil Rights said Tuesday that Cignet Health, which operates two clinics in the county, failed to give a copy of medical records to 41 patients who requested them from September 2008 to October 2009. Under the HIPAA privacy rule, records must be provided no later than 60 days after a request.

Unable to get copies of their records, the patients filed complaints with the HHS Office for Civil Rights, which enforces privacy and security laws. During the investigation, Cignet did not cooperate and refused to provide the records, even after a federal subpoena was issued, according to the Office for Civil Rights.

It is the first time federal officials have imposed a civil penalty for violations of the HIPAA privacy rule since it went into effect in 2003, they said. In previous instances, offenders agreed to change practices or pay fines to settle the case. In July, Rite Aid Corp. and its 40 related entities agreed to pay $1 million to settle potential violations of the Health Insurance Portability and Accountability Act, agreeing to improve policies to safeguard customer privacy when disposing of identifying information on pill bottle labels.

In the case of Cignet Health, "this was really willful neglect," said Rachel Seeger, a spokeswoman for the Office for Civil Rights. "They would not respond to the department." Most of the fine - $3 million - was for willful neglect.

Daniel E. Austin, the owner of Cignet Health, a Christian-influenced health center, did not return calls to his office seeking comment. The Maryland Board of Physicians revoked his license in 2000 for his conviction for mail and loan fraud. Among the physicians listed on the center's Web site is one whose license was revoked in 2008 for engaging in sexual improprieties and sexual misconduct with patients.

Seeger said Cignet also provided health insurance. But last year, the Maryland Insurance Administration ordered Cignet to stop selling health insurance because it was not licensed to do so.

Several of the patients informed Cignet that they were requesting copies of their medical records so they could see doctors other than those working at Cignet, according to HHS documents.

After a federal court in Maryland ordered Cignet to produce the records, the health center delivered 59 boxes of records to the U.S. Justice Department. Inside the boxes were the medical records of the 41 patients - and the medical records of about 4,500 others for whom Cignet had no basis to disclose information, according to documents.

Asked about the records of the 4,500 individuals whose records were not part of the investigation, Seeger said the law requires the provider to be a proper custodian. It is Cignet's responsibility to reunite the records with the patients, she said.

The Office for Civil Rights "will make every effort to make [Cignet] follow the law," she said. In the interim, officials are "guarding these records well in a safe, secure and locked facility."

Staff researcher Lucy Shackelford contributed to this report.