On Thursday, December 12, the Office for Civil Rights announced its second enforcement action and settlement agreement under its HIPAA Right of Access Initiative. Under the settlement agreement, Korunda Medical, LLC, a Florida company providing primary care and interventional pain management, agreed to pay $85,000 and undertake a corrective action plan that includes one year of monitoring.
According to the OCR press release, the enforcement action arose from a March 2019 complaint alleging that Korunda (1) failed to forward a patient’s medical records to a third party as requested by the patient; (2) failed to provide the records in the requested electronic format; and (3) charged the patient more than the “reasonable, cost-based fee” permitted under the HIPAA privacy regulations. After OCR intervened to provide technical assistance in the matter, Korunda continued to fail to provide the requested records, resulting in a second complaint to OCR. Following a second OCR intervention, Korunda provided the records at no charge and in the format requested in May 2019.
A similar $85,000 settlement agreement with corrective action plan was announced in September 2019 against Bayfront Health St. Petersburg, after the hospital allegedly failed to provide a mother timely access to records concerning her unborn child.
The two enforcement actions are part of the Right of Access Initiative announced by OCR earlier this year. OCR has promised to “vigorously enforce the rights of patients to get access to their medical records promptly, without being overcharged, and in the readily producible format of their choice.” Under the HIPAA privacy rules, health care providers generally must respond to requests by patients for access to or copies of their medical information within 30 days, in the format requested by the patient, and at a price limited to a reasonable, cost-based fee. OCR published extensive guidance on the patient’s right of access, which includes the right of patients to direct providers to provide copies of their protected health information to third parties, in a 2016 publication.
OCR’s press release and a copy of the resolution agreement may be viewed at the Health and Human Services website.