Blog# 2092020HIPAA
A healthcare covered entity, Korunda Medical, LLC (Korunda), allegedly failed to provide timely access to a patient’s medical records and agreed to take corrective actions and pay $85,000 to settle a potential violation of HIPAA’s right of access provision. This was a news update from HHS dated December 12, 2019.
HIPAA Right of Access Provision & Patient Rate
The Right of Access provision included a Patient Rate that was established in 2016, a reasonable affordable fee that would allow all patients access to their PHI. While HHS pursued a settlement with Korunda, it was being challenged by Ciox Health for enforcing the privacy rule against business associates (third parties) and costing them millions in lost revenue.
Ciox and many other third party providers did not feel the patient rate should apply to them yet they were bound by their business associate agreements to comply with the Privacy Rule. The covered entities they provided medical records services to, demanded Ciox bill at the patient rate. They went from charging hundreds of dollars to cover the cost of labor to a $6.50 flat rate fee per request.
A court order dated January 23, 2020 now alters right of access provisions in 45 C.F.R. § 164.524. US District Court Judge Amit Mehta decided in Ciox Health, LLC v. Azar, et al., No. 18-cv-0040 (D.D.C. January 23, 2020) that Business Associates are not subject to the same fee limitations imposed by “the patient rate” and determined that HHS was out of jurisdiction to enforce the Privacy Rule against business associates.
According to HHS, “The right of individuals to access their own records and the fee limitations that apply when exercising this right are undisturbed and remain in effect. OCR will continue to enforce the right of access provisions in 45 C.F.R. § 164.524 that are not restricted by the court order.” Hence, the patient fee will only apply when a patient requests access to their own medical records and will not apply when an individual requests transmittal of records to a third party.
Resources
HIPAA Resolution Agreement and Corrective Action Plan
45 C.F.R. §164.524 – Right of Access
45 C.F.R. § 160.103 – Covered Entity
Newly Released FAQs on Access Guidance
New Clarification – $6.50 Flat Rate Option is Not a Cap on Fees for Copies of PHI
Heidi Macomber 