Dive Brief:
- The Office for Civil Rights at HHS announced its second enforcement action against a provider that failed to give a patient their medical records in a timely fashion without overcharging them.
- The action late last week against Naples, Florida-based Korunda Medical, LLC, a primary care and pain management practice, included its agreement to pay $85,000 to settle the charges.
- While Korunda did not admit any wrongdoing as part of the settlement, it did agree to take corrective actions, including employee training and formulating a fee for producing medical records based on its own cost and labor.
Dive Insight:
Although HIPAA has been on the books for nearly a quarter of a century, only in recent months has the OCR taken enforcement actions against providers under the law's "right to access" initiative. The portion of HIPAA and the regulations governing it require covered entities to furnish such records to patients no later than 30 days after a request is made, and that they are charged no more than the cost of producing such records (e.g., making copies).
In September, OCR announced its first settlement with Bayfront Health St. Petersburg, also a Florida-based provider. It also included Bayfront Health making a payment of $85,000 and submitting to a corrective action plan.
In the case of Korunda Medical, a patient had filed a complaint with OCR in March, claiming the organization had failed to forward records in an electronic format, and charged "more than the reasonably cost-based fees allowed under HIPAA," according to an OCR statement.
The agency provided technical assistance to Korunda, but the practice still failed to provide the records, resulting in a second complaint less than three weeks after the first one was lodged and prompting an investigation. Korunda furnished the records free of charge in May.
Under the practice's corrective action plan, it will provide reports to HHS every 90 days on patients requesting their medical information. Korunda also agreed to report to the department any HIPAA violations within 30 days of their discovery. HHS will be monitoring Korunda for the next year.
"For too long, healthcare providers have slow-walked their duty to provide patients their medical records out of a sleepy bureaucratic inertia. We hope our shift to the imposition of corrective actions and settlements under our Right of Access Initiative will finally wake up healthcare providers to their obligations under the law," OCR Director Roger Severino said in a statement.