HHS settlement puts patients’ medical-record access rights in focus
A U.S. Department of Health and Human Services settlement announced August 27, 2026, is putting renewed attention on a basic health-care right: many patients can request copies of their medical records from covered providers and health plans, and those organizations generally must act within 30 calendar days.
HHS’ Office for Civil Rights said it reached a $50,000 settlement with Azul Vision Inc., a California-based provider of optometry and ophthalmology services, after investigating a complaint about delayed access to protected health information.
HHS described the matter as a settlement resolving an OCR investigation into a potential HIPAA violation. It was not a court judgment.
What happened in the Azul Vision case
According to OCR, a patient requested access to her protected health information from Azul Vision in January 2023 and complained to the agency in April 2023. She did not receive access to the information until January 2025, after OCR had begun its investigation.
OCR said Azul Vision failed to provide timely access within 30 days and that the settlement is the agency’s 55th enforcement action under its HIPAA Right of Access Enforcement Initiative.
Under the resolution agreement, Azul Vision agreed to pay $50,000 and implement a corrective-action plan that OCR will monitor for two years. The plan requires the provider to review and revise policies, train workforce members on access requirements and regularly report to HHS the dates it receives and completes access requests.
What patients can generally request
HIPAA’s access right applies to protected health information in a “designated record set” maintained by a covered health-care provider or health plan. That can include medical records, billing information, claims and payment records, enrollment information and case-management records used to make decisions about a patient.
The right is broad, but it does not mean every document must be released. Limited exceptions can include psychotherapy notes and information compiled for use in legal proceedings. A provider should not use a narrow exception to block access to otherwise releasable records, and a partial denial should identify what is being withheld and why.
HIPAA applies to covered entities and business associates within the rule’s scope, not automatically to every business that handles health information.
The federal response deadline
Covered entities generally must act on an access request within 30 calendar days. If they cannot meet that deadline, they may take one additional period of up to 30 days, but they generally must provide a written explanation of the delay within the original response period.
That means a provider does not have an open-ended amount of time to respond. Patients should keep the date and wording of the request, the method used to send it and any follow-up messages.
What providers may charge
HIPAA generally permits reasonable, cost-based fees connected to making and delivering copies, such as supplies and postage. Patients may also agree to pay for services such as preparing a summary or explanation of the records.
Fees generally may not include costs for searching, retrieving or maintaining the system that stores the records. Patients can also request the records in a particular format, such as an electronic copy, when the provider can readily produce them that way.
What to do if a request stalls
Submit the request in writing and identify the records, date range, preferred format and delivery method. Ask the provider to confirm when it received the request.
Before the 30-day deadline expires, follow up with the medical-records, privacy or compliance office. If the deadline passes or the response is incomplete, document the problem and ask the provider to explain which records are being withheld and why.
Patients who believe their access rights were violated can file a complaint with HHS’ Office for Civil Rights. OCR enforcement is discretionary, so a complaint does not guarantee that the agency will obtain records or impose a penalty. The Azul Vision settlement nevertheless shows that prolonged delays can lead to federal scrutiny, corrective requirements and a financial settlement.
Sources
Look for updates to this story
Discover more from Interactive News
Subscribe to get the latest posts sent to your email.