The U.S. Department of Health and Human Services’ Office for Civil Rights announced a settlement with Azul Vision, a California-based optometry and ophthalmology provider, resolving a complaint over delayed access to a patient’s medical records and marking a notable Azul Vision HIPAA right of access enforcement action.
What Prompted This Azul Vision HIPAA Right of Access Case
OCR opened its investigation after receiving a complaint in April 2023 alleging that Azul Vision failed to provide an individual timely access to her protected health information following a January 2023 request. The individual did not receive her records until January 2025, nearly two years after her initial request and only after OCR had already begun investigating.
The Underlying HIPAA Standard at Issue
The HIPAA Privacy Rule’s right of access provisions require covered entities to provide individuals timely access to their health information within 30 days, with the possibility of one additional 30-day extension. OCR determined Azul Vision potentially failed to meet that standard.
Why This Azul Vision HIPAA Right of Access Settlement Is Notable
The settlement marks OCR’s 55th enforcement action under its Right of Access Enforcement Initiative, a program the agency launched during the first Trump administration specifically to address complaints about delayed or denied patient record access. “The right of access is key to empowering individuals to take control of their own health,” OCR Director Paula M. Stannard said, adding that it should not be necessary for OCR to open an investigation before a covered entity provides requested records.
Why Reaching This Milestone Matters
Reaching a 55th enforcement action under this specific initiative signals that delayed patient record access remains a persistent compliance issue across the healthcare industry years after the program’s launch, rather than a problem that has been substantially resolved through earlier enforcement actions alone.
The Terms of This Azul Vision HIPAA Right of Access Resolution
Under the resolution agreement, Azul Vision agreed to pay $50,000 to OCR and implement a corrective action plan that the agency will monitor for two years. The plan requires Azul Vision to review and revise its written policies and procedures for compliance with the Privacy Rule, regularly submit to HHS a log of PHI access requests including receipt and completion dates, and ensure all workforce members receive training on right of access requirements and the organization’s own implementing procedures.
Why Ongoing Reporting Requirements Matter
Requiring Azul Vision to regularly submit its PHI access request logs to HHS throughout the two-year monitoring period gives OCR an ongoing compliance verification mechanism, rather than relying solely on the corrective action plan’s policy and training requirements to prevent similar delays from recurring.
How This Fits OCR’s Broader HIPAA Enforcement Pattern
This settlement follows other recent OCR enforcement actions, including a ransomware investigation settlement with a healthcare system in July and a separate ransomware settlement with a health plan in June, reflecting continued active enforcement across multiple categories of HIPAA violations simultaneously.
Why Right of Access Cases Persist Alongside Cybersecurity Enforcement
The continued frequency of right of access settlements alongside cybersecurity-related HIPAA enforcement actions suggests that basic administrative compliance failures, like meeting the 30-day access deadline, remain a distinct and ongoing enforcement priority for OCR, separate from and in addition to the agency’s data breach and ransomware-related casework.
What This Azul Vision HIPAA Right of Access Settlement Means Going Forward
With the two-year corrective action plan now in effect, Azul Vision will need to demonstrate sustained compliance through its ongoing reporting obligations to HHS, giving the agency continued visibility into whether the practice’s PHI access timelines improve. Given that this represents OCR’s 55th action under this specific initiative, healthcare providers of all sizes, including smaller specialty practices like Azul Vision, should treat the 30-day access requirement as an active enforcement priority rather than a rarely tested technicality.
What to Watch Going Forward
As OCR continues its Right of Access Enforcement Initiative, industry observers will likely watch whether the pace of these settlements continues at a similar rate or whether broader awareness of the 30-day requirement reduces future violations. Given the specific corrective action requirements imposed here, including mandatory workforce training and regular access-request reporting, this Azul Vision HIPAA right of access settlement may serve as a practical compliance checklist for other small and mid-sized healthcare providers seeking to avoid similar enforcement action.
For more healthcare industry updates, insights and news, visit DistilINFO. Click here to subscribe to stay informed.
