OCR Settles HIPAA Right of Access Violation Case with Azul Vision
The HHS’ Office for Civil Rights (OCR) has announced that a settlement has been agreed with a California-based healthcare provider to resolve an alleged violation of the HIPAA right of access. Azul Vision, an optometry and ophthalmology services provider, has agreed to pay a $50,000 financial penalty to resolve the alleged Privacy Rule violation.
OCR launched a HIPAA right of access enforcement initiative during President Trump’s first term, and 55 financial penalties have now been imposed for HIPAA right of access violations under this initiative. The HIPAA right of access standard requires HIPAA covered entities to provide individuals with a copy of their health records on request. The requested records should be provided within 30 days of receipt of a request, although a 30-day extension is possible. Individuals may only be charged a reasonable, cost-based fee for exercising their right to obtain a copy of their health records.
OCR received a complaint from an Azul Vision patient in April 2023 alleging she submitted a request for a copy of her health records in January 2023, but they had not been provided within those three months. OCR launched an investigation, and the requested records were provided to the patient, although not until January 2025 – two years after the initial request was received.
OCR determined that Azul Vision had failed to provide the patient with timely access to her health records, as is required by the HIPAA right of access standard of the HIPAA Privacy Rule. OCR notified Azul Vision of the findings of its investigation and the intention to impose a financial penalty, and the case was settled. In addition to the financial penalty, Azul Vision is required to adopt a corrective action plan to address the area of noncompliance identified by OCR.
Policies and procedures must be reviewed and revised, as necessary, to ensure compliance with the HIPAA Privacy Rule, training must be given to workforce members on the HIPAA Right of Access and internal policies and procedures, and Azul Vision must submit lists to OCR of all right of access requests received, including the date each request was received and the date that the requested records were provided.
“OCR’s 55th enforcement action in the Right of Access Initiative demonstrates the Trump Administration’s commitment to enforcing timely access to requested protected health information,” said OCR Director Paula M. Stannard. “The right of access is key to empowering individuals to take control of their own health. It should not be necessary for OCR to initiate a right of access investigation before a covered entity will provide an individual with access to their requested records.”
