OCR enforces second case under HIPAA right-of-access initiative

The Office for Civil Rights (OCR) reached a settlement with Korunda Medical LLC, a Florida-based company, on December 11 for a potential violation of the HIPAA Privacy Rule’s right-of-access provision.

Korunda, which offers primary care and interventional pain management to approximately 2,000 patients annually, failed to provide the electronic format of a patient’s record in a timely manner and charged more than the reasonably cost-based fees allowed under HIPAA, according to an OCR press release.

Korunda agreed to pay OCR $85,000 and implement corrective actions for the potential violation. This marks the second enforcement action and settlement under OCR’s HIPAA Right of Access initiative, which was announced earlier this year to vigorously enforce patients’ rights to obtain their medical records promptly — and in the format of their choice — without being overcharged.

The settlement stems from a March 2019 complaint that alleged Korunda failed to forward a patient’s medical records in electronic format to a third party despite repeated requests. After receiving the complaint, OCR provided Korunda with technical assistance to resolve the issue, but days later a second complaint was made concerning Korunda’s continued noncompliance, according to OCR. As a result of the follow-up complaint, the requested records were provided for free and in the desired format.

Earlier this year, Bayfront Health St. Petersburg, a Florida hospital, paid OCR $85,000 and adopted a corrective action plan for allegedly violating HIPAA Privacy Rule’s right-of-access provision.