By Matt Fisher, Healthcare Attorney
LinkedIn: Matthew Fisher
X: @matt_r_fisher
Host of Healthcare de Jure – #HCdeJure
While the pace of settlements announced by the Office for Civil Rights has slowed significantly in the past year and a half, the newest one announced on August 27, 2026 brings the right of access under HIPAA back to the fore. In what is certainly the first right of access settlement in 2026, and for a bit of time before that, OCR offers a reminder that individuals still face challenges in timely getting copies of their records.
The Bare Factual Background
The recent settlement involved Azul Vision, Inc. (Azul), which followed an initial complaint filed by an individual on April 27, 2023. The complainant reportedly submitted a request for records to Azul on January 9, 2023. Given the timing of the complaint, the individual seemed to wait both the initial 30 days and the one 30 day extension that an organization can take in order to respond to a request for access.
According to the announcement, OCR initiated its investigation at some point after the complaint was filed. Then, pretty much 2 years after the initial request for access was presented, Azul finally provided the record on January 6, 2025.
Unfortunately, OCR provided absolutely no other details. The only statement from OCR was that Azul did not timely respond to the individual’s request for access. Given the two year gap between the initial request and the actual production, OCR’s statement is a bit of an understatement.
The only other detail from the resolution to note is that Azul’s actions cost it $50,000. That amount is likely to impose a bit of financial pain, but hard to know exactly how much.
Just Respond
The lack of details makes it a little hard to parse through any specific lessons to learn from the Azul settlement. That is, lessons other than the clear one of just give individuals their records when requested. Previous OCR settlements have provided a bit more insight into the specific conduct. For example, did OCR provide technical guidance that was ignored? Did the organization ignore the request, try to respond, or take other steps that had some back and forth? The lack of background makes it hard to know how events got to where they did.
Without those details, as noted about the only lesson to glean is that organizations need to provide information when a request is submitted. It seems like that statement is a broken record from even before OCR started the enforcement series. However, it should be crystal clear at this point in time. OCR notes that the Azul settlement is the 55th in the right of access initiative. It would be helpful to go back and count, but whatever the number it is a lot of enforcement for a right that should be relatively clear to abide by. Even if an organization is not going to meet the required timeframes (which seems like it shouldn’t be an issue), if there is open communication with the individual then it would seem unlikely to get to the point of a complaint and enforcement.
Conclusion
When will the right of access initiative actually end? As suggested, the reminders through financial penalties seem necessary. The process does not work as it should, but maybe is getting better? That is an open question that only the industry can answer. Maybe the biggest lingering issue is when enforcement under the parallel information blocking regulations will occur that draw another set of lessons and insights.
This article was originally published on The Pulse blog and is republished here with permission.