The Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services is announcing its second enforcement action and settlement under its HIPAA1 Right of Access Initiative. OCR announced this initiative earlier this year promising to vigorously enforce the rights of patients to get access to their medical records promptly, without being overcharged, and in the readily producible format of their choice. Korunda Medical, LLC (Korunda) has agreed to take corrective actions and pay $85,000 to settle a potential violation of HIPAA’s right of access provision. Korunda is a Florida-based company that provides comprehensive primary care and interventional pain management to approximately 2,000 patients annually.
In March of 2019, OCR received a complaint concerning a Korunda patient alleging that, despite repeatedly asking, Korunda failed to forward a patient’s medical records in electronic format to a third party. Not only did Korunda fail to timely provide the records to the third party, but Korunda also failed to provide them in the requested electronic format, and charged more than the reasonably cost-based fees allowed under HIPAA. OCR provided Korunda with technical assistance on how to correct these matters and closed the complaint. Despite OCR’s assistance, Korunda continued to fail to provide the requested records, resulting in another complaint to OCR. As a result of OCR’s second intervention, the requested records were provided for free in May 2019, and in the format requested.
“For too long, healthcare providers have slow-walked their duty to provide patients their medical records out of a sleepy bureaucratic inertia. We hope our shift to the imposition of corrective actions and settlements under our Right of Access Initiative will finally wake up healthcare providers to their obligations under the law,” said Roger Severino, OCR Director.
In addition to the monetary settlement, Korunda will undertake a corrective action plan that includes one year of monitoring. The resolution agreement and corrective action plan may be found at: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/korunda/index.html.
[ PUBLISHER COMMENT — Besides the primary message that OCR is coming after covered entities that 1) fail to provide timely access and copies 2) in the format requested 3) at the HIPAA authorized rate, there is another major take-away here. This is the second fine case this month where OCR told the covered entity that they were doing something wrong and the covered entity ignored the warning. It appears that OCR will take special interest in fining those organizations and providers that fail to respond to OCR warnings.]