Azul Vision Settles HIPAA Right of Access Case for $50,000
The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has announced its 9th financial penalty of the year to resolve an alleged violation of the HIPAA Rules, and its 55th penalty under its HIPAA Right of Access enforcement initiative.
Azul Vision Inc. is a California-based provider of optometry and ophthalmology services. OCR launched an investigation in response to a complaint from a patient who alleged that she had not been provided with timely access to her medical records. The complaint was filed with OCR in April 2023, three months after the patient submitted a request to Azul Vision for a copy of her health information. She did not receive the requested records until January 2025 – two years after her request was submitted.
The HIPAA Privacy Rule gives patients the right to timely access to their medical records for a reasonable, cost-based fee. When a healthcare provider receives a request from a patient wishing to exercise that right, the healthcare provider has 30 days from receipt of the request to provide the requested records, although under certain circumstances, a 30-day extension is possible. OCR’s investigation determined that Azul Vision failed to take timely action in response to the request, in violation of the right of access standard of the HIPAA Privacy Rule.
Under OCR’s enforcement initiative, the HIPAA violation warranted a financial penalty. Azul Vision was given the opportunity to settle the alleged violation informally, and a $50,000 financial penalty was agreed to resolve the investigation. In addition to the financial penalty, Azul Vision has agreed to adopt a corrective action plan to address the alleged violation and ensure future compliance with the HIPAA Rules.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The corrective action plan requires Azul Vision to review and revise its policies and procedures to comply with the HIPAA Privacy Rule and ensure its workforce receives training on the HIPAA right of access and Azul Vision’s policies and procedures. Azul Vision will be monitored for compliance with the corrective action plan and must submit reports to OCR of all right of access requests, including the date the requests were received and the completion dates.
“OCR’s 55th enforcement action in the Right of Access Initiative demonstrates the Trump Administration’s commitment to enforcing timely access to requested protected health information,” said OCR Director Paula M. Stannard. “The right of access is key to empowering individuals to take control of their own health. It should not be necessary for OCR to initiate a right of access investigation before a covered entity will provide an individual with access to their requested records.”
