OCR Settles Second Case in HIPAA Right of Access Initiative
This is the second settlement for Right of Access
Final
Issued by: Office for Civil Rights (OCR)
Issue Date: July 11, 1905
OCR Settles Second Case in HIPAA Right of Access Initiative
The Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services is announcing its second enforcement action and settlement under its HIPAA1 Right of Access Initiative. OCR announced this initiative earlier this year promising to vigorously enforce the rights of patients to get access to their medical records promptly, without being overcharged, and in the readily producible format of their choice. Korunda Medical, LLC (Korunda) has agreed to take corrective actions and pay $85,000 to settle a potential violation of HIPAA's right of access provision. Korunda is a Florida-based company that provides comprehensive primary care and interventional pain management to approximately 2,000 patients annually.
In March of 2019, OCR received a complaint concerning a Korunda patient alleging that, despite repeatedly asking, Korunda failed to forward a patient's medical records in electronic format to a third party. Not only did Korunda fail to timely provide the records to the third party, but Korunda also failed to provide them in the requested electronic format, and charged more than the reasonably cost-based fees allowed under HIPAA. OCR provided Korunda with technical assistance on how to correct these matters and closed the complaint. Despite OCR's assistance, Korunda continued to fail to provide the requested records, resulting in another complaint to OCR. As a result of OCR's second intervention, the requested records were provided for free in May 2019, and in the format requested.
"For too long, healthcare providers have slow-walked their duty to provide patients their medical records out of a sleepy bureaucratic inertia. We hope our shift to the imposition of corrective actions and settlements under our Right of Access Initiative will finally wake up healthcare providers to their obligations under the law," said Roger Severino, OCR Director.
In addition to the monetary settlement, Korunda will undertake a corrective action plan that includes one year of monitoring. The resolution agreement and corrective action plan may be found at: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/korunda/index.html.
HHS is committed to making its websites and documents accessible to the widest possible audience, including individuals with disabilities. We are in the process of retroactively making some documents accessible. If you need assistance accessing an accessible version of this document, please reach out to the guidance@hhs.gov.
DISCLAIMER: The contents of this database lack the force and effect of law, except as authorized by law (including Medicare Advantage Rate Announcements and Advance Notices) or as specifically incorporated into a contract. The Department may not cite, use, or rely on any guidance that is not posted on the guidance repository, except to establish historical facts.