Korunda Medical to Pay $85,000 Penalty for HIPAA Right of Access Failures

The Department of Health and Human Services’ Office for Civil Rights issued its second enforcement action according to its HIPAA Right of Access Initiative. Korunda Medical based in Florida made an agreement to settle potential HIPAA Right of Access violations, will undertake a corrective action plan and make its policies and procedures consistent with the demands of the HIPAA Privacy Regulation.

In March 2019, a patient submitted a complaint to OCR that Korunda Medical did not give her requested copy of medical records in the electronic format asked for even with repeated requests. Allegedly, Korunda Medical declined to give to a third party an electronic copy of her medical records and was charging the patients too much for the copies of their health records. According to HIPAA, covered entities can only charge a fair, cost-based fee for giving patients access to their protected health information (PHI).

The first complaint was submitted to OCR on March 6, 2019. OCR offered technical support to Korunda Medical regarding the HIPAA Right of Access on March 18, 2019 and closed the issue. After four days, OCR got another complaint which showed that Korunda Medical still did not comply with the HIPAA Right of Access. OCR notified Korunda Medical on May 8, 2019 about the start of a compliance investigation. Due to OCR’s intervention, the complaining patient got a copy of her medical records for free. Because of the continued noncompliance with the HIPAA Right of Access, Koruda Medical was issued an $85,000 financial penalty.

For a long time, healthcare companies have delayed in providing patients their health records due to sleepy bureaucratic inertia. It is hoped that as OCR shifts its enforcement of corrective actions and settlements according to the Right of Access Initiative, healthcare companies will finally arise to their responsibilities as required by law.

The HIPAA Right of Action Initiative is an enforcement drive by HIPAA to make sure that HIPAA-covered entities provide patients copies of their medical records promptly, in the file format they request, and without paying too much. In September 2019, the first enforcement action under this initiative was issued to Bayfront Health St Petersburg, which paid $85,000 in financial penalties to settle its HIPAA Right of Access failures.

This HIPAA enforcement action is the ninth this year. OCR has resolved 8 HIPAA violation cases in 2019 and has announced one civil monetary penalty. The financial penalties ranged from $10,000 to $3 million. To date, OCR received $12,209,000 in payments to settle HIPAA violations.

Elizabeth Hernandez

Elizabeth Hernandez is the editor of HIPAA News section of HIPAA Coach and an experienced journalist in the healthcare sector. She specializes in healthcare and HIPAA compliance, making her a go-to source for information on healthcare regulations. Her work focuses on the importance of patient privacy and secure information handling. Elizabeth also has a postgraduate degree in journalism. Follow on Twitter: You can follow Elizabeth on twitter at https://twitter.com/ElizabethHzone