OCR Settles Second Case in HIPAA Right of Access Initiative but then Vacates 3rd Party Directive in Federal Court

Blog# 2092020HIPAA

HHS OCR Settle Second Case in HIPAA Right of Access Initiative 12/12/2019 but then vacates 3rd Party Directive in court decision dated 1/23/2020.

A healthcare covered entity, Korunda Medical, LLC (Korunda), allegedly failed to provide timely access to a patient’s medical records and agreed to take corrective actions and pay $85,000 to settle a potential violation of HIPAA’s right of access provision. This was a news update from HHS dated December 12, 2019.

HIPAA Right of Access Provision & Patient Rate

The Right of Access provision included a Patient Rate that was established in 2016, a reasonable affordable fee that would allow all patients access to their PHI. While HHS pursued a settlement with Korunda, it was being challenged by Ciox Health for enforcing the privacy rule against business associates (third parties) and costing them millions in lost revenue.

Ciox and many other third party providers did not feel the patient rate should apply to them yet they were bound by their business associate agreements to comply with the Privacy Rule. The covered entities they provided medical records services to, demanded Ciox bill at the patient rate. They went from charging hundreds of dollars to cover the cost of labor to a $6.50 flat rate fee per request.

A court order dated January 23, 2020 now alters right of access provisions in 45 C.F.R. § 164.524. US District Court Judge Amit Mehta decided in Ciox Health, LLC v. Azar, et al., No. 18-cv-0040 (D.D.C. January 23, 2020) that Business Associates are not subject to the same fee limitations imposed by “the patient rate” and determined that HHS was out of jurisdiction to enforce the Privacy Rule against business associates.

According to HHS, “The right of individuals to access their own records and the fee limitations that apply when exercising this right are undisturbed and remain in effect.  OCR will continue to enforce the right of access provisions in 45 C.F.R. § 164.524 that are not restricted by the court order.” Hence, the patient fee will only apply when a patient requests access to their own medical records and will not apply when an individual requests transmittal of records to a third party.


HHS 12/12/19 Press Release

HIPAA Resolution Agreement and Corrective Action Plan

45 C.F.R. §164.524 – Right of Access

45 C.F.R. § 160.103 – Covered Entity

Newly Released FAQs on Access Guidance

New Clarification – $6.50 Flat Rate Option is Not a Cap on Fees for Copies of PHI

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s