Florida-based company pays thousands for not giving patients medical records

A Florida company will pay $85,000 and take corrective actions to settle allegations they violated HIPAA’s right to access provision, according to a news release from the HHS Office For Civil Rights (OCR).

Korunda Medical, LLC, agreed to the payment and actions to settle a complaint from March 2019 where OCR received a complaint the company failed to forward a patient’s medical records in an electronic format to a third party in a timely fashion, the release says.

This is the second time OCR has taken action as part of their Right of Access Initiative which was announced earlier in 2019 in order to enforce patients’ rights to their medical records promptly, without being overcharged, in a readily producible format of their choice, according to the release.

The first action was settled in September and saw Bayfront Health St. Petersburg, of Florida, paying $85,000 and taking corrective actions, according to a news release at the time.

Korunda was accused of also failing to provide the records in the requested electronic format and charging more than the reasonably cost-based fees allowed under HIPAA. They received technical assistance from OCR on correcting the matters and the office closed the complaint, according to the release.

Despite this, Korunda still failed to provide the requested records leading to a second complaint being filed with OCR. Due to the continued failure, OCR intervened, and the medical records were provided in the proper format for free in May 2019, the release says.

"For too long, healthcare providers have slow-walked their duty to provide patients their medical records out of a sleepy bureaucratic inertia,” Roger Severino, OCR director, says in the release. “We hope our shift to the imposition of corrective actions and settlements under our Right of Access Initiative will finally wake up healthcare providers to their obligations under the law."

stipulates that Korunda did not admit liability while HHS has made no concessions. The corrective action plan includes a year of monitoring by OCR to ensure Korunda reviews and revises policies and procedures for individual access protected health information, privacy training on individual access to this information, access request status requirements, and report any time one of their employees do not comply with access policies.