The U.S. Department of Health and Human Services Office for Civil Rights, or OCR, announced a $50,000 settlement with Azul Vision, Inc. following an investigation into a potential violation of the HIPAA Privacy Rule.
Azul Vision is a California healthcare provider that offers optometry and ophthalmology services. The investigation involved a complaint that the organization failed to provide a patient with timely access to her protected health information, or PHI.
Patient Waited Almost Two Years for Health Records
OCR received the complaint in April 2023. According to the complaint, the patient requested access to her health information in January 2023 but did not receive the requested records within the required timeframe.
The patient eventually received her records in January 2025, almost two years after the original request and only after OCR had opened an investigation.
OCR determined that Azul Vision may have failed to take timely action on the patient’s request as required by the HIPAA Privacy Rule.
HIPAA Right of Access Requirements
The HIPAA Privacy Rule gives individuals and their personal representatives the right to inspect or obtain copies of their health information.
Covered entities are generally required to respond to an access request within 30 calendar days. When additional time is permitted, the organization may take one 30-day extension after providing the individual with written notice explaining the reason for the delay and the expected completion date.
The right of access allows individuals to review their medical information, make informed healthcare decisions, share records with other providers, and take a more active role in managing their health.
OCR’s 55th Right of Access Enforcement Action
The Azul Vision settlement represents OCR’s 55th enforcement action under its HIPAA Right of Access Initiative.
“OCR’s 55th enforcement action in the Right of Access Initiative demonstrates the Trump Administration’s commitment to enforcing timely access to requested protected health information,” said OCR Director Paula M. Stannard.
She added that access to health information is essential for helping individuals take control of their healthcare and that patients should not have to wait for an OCR investigation before receiving their requested records.
Settlement and Corrective Action Requirements
Under the resolution agreement, Azul Vision agreed to:
- Pay $50,000 to OCR
- Implement a corrective action plan
- Allow OCR to monitor its compliance for two years
- Review and revise its HIPAA right of access policies and procedures
- Regularly provide HHS with information about received access requests and response dates
- Train workforce members on HIPAA right of access requirements
- Train employees on the organization’s updated access policies and procedures
The corrective action plan is intended to help ensure that future requests for health records are handled correctly and within the required timeframe.
Key Compliance Lesson
This settlement shows that healthcare organizations must maintain a clear and reliable process for receiving, reviewing, tracking, and completing patient record requests.
Covered entities should document when each request is received, identify the applicable deadline, communicate promptly with the individual, and confirm when the records are provided. Delayed or ignored requests may result in complaints, investigations, corrective action plans, financial settlements, and ongoing federal monitoring.
The resolution agreement and corrective action plan are available through the HHS Office for Civil Rights announcement:
https://www.hhs.gov/press-room/hhs-ocr-settles-hipaa-investigation-with-azul-vision.html