Part 2 of 2: Seven years after OCR’s first HIPAA Right of Access enforcement action, case #55 shows why timely access to medical records remains a compliance issue for healthcare providers.

A patient waited nearly two years for her medical records. Now Azul Vision will pay $50,000 and spend two years under a corrective action plan.

OCR Director Paula M. Stannard has made the agency’s position clear: OCR should not have to investigate a covered entity for a patient to receive their requested medical records.

The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has announced its 55th HIPAA Right of Access enforcement action, reaching a $50,000 settlement with Azul Vision, Inc.

The August 27, 2026 settlement involved a potential violation of the HIPAA Privacy Rule after a patient waited nearly two years to receive requested health information.

What Happened?

According to OCR, the patient requested access to her protected health information (PHI) in January 2023. After she did not receive the requested records, a complaint was filed with OCR in April 2023. The patient ultimately received access to her records in January 2025, almost two years later and only after OCR had started its investigation.

OCR determined that Azul Vision potentially failed to take timely action as required by HIPAA’s Right of Access standard.

The case reinforces a simple compliance lesson: organizations need to know when an access request arrives, who is responsible for it, and how long it has been open.

Understanding HIPAA’s 30-Day Rule

The HIPAA Privacy Rule generally requires covered entities to act on an individual’s request for access to PHI within 30 calendar days. When an organization cannot complete the request, HIPAA permits one additional 30-day extension which requires written notice of the delay be sent to the individual.

A request that sits unanswered for months can expose an organization to regulatory action.

$50,000 Settlement and Two Years of Monitoring

Under the resolution agreement, Azul Vision agreed to:

• Pay $50,000 to OCR.
• Review and revise its Right of Access policies and procedures as necessary.
• Regularly provide HHS with information about access requests, including when requests were received and completed.
• Train workforce members on Right of Access requirements and related policies and procedures.
• Operate under a corrective action plan monitored by OCR for two years.

The payment is only one consequence. Regulatory monitoring, policy revisions, workforce training, and ongoing reporting create additional costs and demands on an organization.

Could This Happen to Your Practice?

You don’t need to be a large hospital system to have a Right of Access problem. A request can come into your practice, be passed to another employee, and then get buried among emails, paperwork, and everyday responsibilities.

Meanwhile, the compliance clock keeps moving.

Can your practice answer these four questions today?

• How many patient access requests are currently open?
• Who is responsible for each request?
• How many days has each request been outstanding?
• Will you know before a request approaches its HIPAA deadline?

If those answers aren’t readily available, it may be time to review how your practice manages access requests.

Tools such as uRISQ’s Data Subject Access Request module can help provide a structured way to manage, assign, document, and track requests through completion.

The Bottom Line

Azul Vision marks the 55th enforcement action under OCR’s HIPAA Right of Access Initiative.

The lesson is straightforward: receiving a patient records request starts a compliance process that needs to be tracked through completion.

Healthcare organizations should not depend solely on emails, spreadsheets, or individual employees remembering deadlines. A documented and repeatable process can help identify open requests, maintain accountability, and reduce the risk that a patient waits months or nearly two years for access to their health information.

After 55 Right of Access enforcement actions, healthcare providers should be asking a simple question:

Are our procedures actually working?