In August 2026, the HHS Office for Civil Rights (OCR) announced a $50,000 settlement with Azul Vision after a patient waited nearly two years to receive her requested medical records. The patient submitted the request on January 9, 2023, but Azul Vision did not provide the records until two years later, on January 6, 2025, after OCR had already begun investigating a complaint.

 

What happened

Investigators reviewed whether the California eye care provider had acted on the request within the timeframe required by the HIPAA Privacy Rule. The requested records were ultimately provided on January 6, 2025, after OCR had initiated its investigation and almost two years after the request. OCR determined that Azul Vision’s handling of the request represented a potential violation of 45 CFR § 164.524(b).

The parties resolved the investigation without a formal finding of liability, and Azul Vision did not admit wrongdoing. Under the agreement, signed in August 2026, Azul Vision paid $50,000 and accepted a two-year corrective action plan monitored by OCR. The organization must review its access policies, distribute them to workers, obtain compliance certifications, and provide annual right-of-access training. Every 90 days, it must submit records of access requests, response dates, requested and supplied formats, page totals, fees, and any denials.

 

In the know

Under the HIPAA Privacy Rule’s right-of-access standard, covered entities generally must act on a records request within 30 days by providing the requested information or issuing a written denial. An organization may take one additional 30-day extension only if it notifies the individual in writing within the original deadline, explains the reason for the delay, and provides a completion date. The complaint indicated that the request remained unresolved beyond these permitted timeframes, prompting OCR to examine Azul Vision’s handling of the request.

 

What was said

In the press release, OCR Director Paula M. Stannard noted, “OCR’s 55th enforcement action in the Right of Access Initiative demonstrates the Trump Administration’s commitment to enforcing timely access to requested protected health information. The right of access is key to empowering individuals to take control of their own health. It should not be necessary for OCR to initiate a right of access investigation before a covered entity will provide an individual with access to their requested records.”

 

Why it matters

The Azul Vision settlement follows a pattern seen in other HIPAA Right of Access enforcement actions by the HHS. In 2024, Phoenix Healthcare agreed to pay $35,000 after taking 323 days to provide records to a patient’s daughter, who was acting as her mother’s personal representative. OCR initially sought a $250,000 penalty, while an administrative law judge later found willful neglect and reduced the amount to $75,000 before the parties reached the final settlement.

In another case, Optum Medical Care paid $160,000 after OCR investigated six complaints involving record-access delays ranging from 84 to 231 days. Like Azul Vision, both organizations were required to revise their access procedures, train workforce members, and demonstrate continued compliance. Although the circumstances and financial consequences differed, all three actions began with patient complaints and concerned failures to complete medical-record requests within HIPAA’s required timeframe.

See also: HIPAA Compliant Email: The Definitive Guide (2026 Update)

 

FAQs

Can a provider require the request to be submitted in writing?

Yes, a provider may require a written request if it informs patients of that requirement and does not use the process to create unnecessary barriers.

 

Does placing records in a patient portal satisfy the right of access?

Not necessarily, because a covered entity may still need to provide the records through another requested method or format when it is readily producible.

 

Can patients have their records sent directly to another person?

Yes, patients may direct a covered entity to send records to another person through a signed written request that clearly identifies the recipient and delivery location.

 

May providers charge patients for copies?

Providers may charge a reasonable, cost-based fee covering permitted copying labor, supplies, postage, and an agreed-upon summary or explanation.