OCR Agrees to $112,500 Settlement with Concentra to Resolve HIPAA Right of Access Violation
Concentra Inc. has agreed to settle an alleged violation of the HIPAA Right of Access with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) and will pay a $112,500 financial penalty, despite contesting OCR’s determination that there had been a HIPAA violation.
The HIPAA Privacy Rule gives individuals rights over their protected health information (PHI), including the right to obtain a copy of their PHI and only be charged a reasonable, cost-based fee. If a request for a copy of an individual’s medical records is received by a HIPAA-covered entity, the requested records must be provided within 30 days. The records should be provided in the format requested, provided that the covered entity is able to readily produce them in the requested format. OCR launched an enforcement initiative in late 2019 targeting noncompliance with this HIPAA Privacy Rule provision after receiving multiple complaints from individuals who had not been provided with their requested records in a timely manner. Including the latest penalty, OCR has imposed 54 financial penalties under this enforcement initiative.
Concentra is an Addison, Texas-based healthcare provider, a HIPAA-covered entity, that specializes in occupational health. Concentra runs 547 occupational health centers and 151 onsite health clinics at employer worksites in more than 40 U.S. states. OCR launched an investigation in response to a complaint from an individual who had not been provided with a copy of his protected health information, despite making six separate requests, the first of which was received by Concentra’s Peoria, Arizona, Center on February 15, 2018.
The patient requested an electronic copy of his medical and billing records in February 2018, and a Concentra employee forwarded the access request to Concentra’s Central Billing Office (CBO). The patient sent further requests to the same Peoria office in 2018, and they were also forwarded to the CBO, but the records were not provided. OCR determined that on October 8, 2018, Concentra’s business associate raised an invoice for $82.57 to produce a copy of the requested records. The invoice was disputed, and on March 19, 2019, the bill was adjusted to a flat fee of $6.50, and the records were mailed in paper format.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
OCR notified Concentra that the investigation had identified a potential violation of the HIPAA Right of Access for not providing the records within 30 days. Concentra responded and disputed the preliminary findings of the investigation and submitted evidence in support of its position. OCR responded and proposed a $250,000 financial penalty to resolve the violation, having rejected Concentra’s evidence. Concentra requested a hearing with an Administrative Law Judge to contest the proposed civil monetary penalty. Concentra and OCR then engaged in settlement discussions and, on May 5, 2025, prior to an administrative hearing, both parties agreed to settle the case with a $112,500 financial penalty.
“Under the HIPAA Privacy Rule, individuals or their personal representatives have the right to timely access [to] their medical records,” said OCR Director Paula M. Stannard. “Individuals should not have to make multiple requests and file a complaint with OCR to gain access to their health information.” OCR has been particularly active in 2025 in enforcing compliance with the HIPAA Rules. The Concentra HIPAA fine is the 21st penalty imposed by OCR this year to resolve alleged violations of the HIPAA Rules.
