HHS’ Office for Civil Rights has settled its 55th enforcement action under the HIPAA Right of Access Initiative.
OCR opened its investigation after receiving a complaint in April 2023 alleging that Azul Vision, a California-based optometry and ophthalmology provider, failed to provide a patient timely access to her protected health information following a January 2023 request. The patient did not receive her records until January 2025 — nearly two years later and only after OCR’s investigation began. The HIPAA Privacy Rule requires covered entities to provide patients access to their health records within 30 days, with one possible 30-day extension.
Azul Vision agreed to pay $50,000 to OCR and will operate under a two-year corrective action plan. The plan requires the provider to revise its access policies, regularly report PHI access requests to HHS and train staff on right-of-access procedures.
“OCR’s 55th enforcement action in the Right of Access Initiative demonstrates the Trump Administration’s commitment to enforcing timely access to requested protected health information,” OCR Director Paula Stannard said in a late August news release. “It should not be necessary for OCR to initiate a right of access investigation before a covered entity will provide an individual with access to their requested records.”
OCR launched the Right of Access Initiative in 2019, during the first Trump administration, to crack down on providers that fail to promptly turn over patient records.
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.
