Azul Vision Settles HIPAA Right of Access Case for $50,000
The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has reached a $50,000 settlement with Azul Vision Inc. over an alleged failure to provide a patient timely access to medical records.
The settlement represents OCR’s ninth financial penalty of 2026 to resolve an alleged violation of the HIPAA Rules and its 55th financial penalty under its HIPAA Right of Access enforcement initiative. Azul Vision Inc. offers optometry and ophthalmology services, with a presence in California.
Patient Access Request
OCR opened an investigation after a patient complained that Azul Vision had not provided timely access to her medical records. The complaint was filed with OCR in April 2023, three months after the patient submitted a request to Azul Vision for a copy of her health information. The provider failed to give the patient the requested records promptly. The records were provided only in January 2025, two years after the original request was submitted.
According to the HIPAA Privacy Rule, patients have a right to timely access to their medical records for a reasonable, cost-based fee. A healthcare provider generally has 30 days after receiving a request to provide the requested records. Under certain circumstances, a 30-day extension is possible.
OCR Investigation
OCR determined that Azul Vision failed to take timely action in response to the patient’s request. OCR found that the conduct violated the right of access standard of the HIPAA Privacy Rule and as a result issued a financial penalty. Azul Vision took advantage of the opportunity to resolve the alleged violation informally and agreed to a $50,000 financial penalty to resolve the investigation.
In addition to the $50,000 financial penalty, Azul Vision agreed to adopt a corrective action plan addressing the alleged violation and future compliance with the HIPAA Rules. The corrective action plan requires Azul Vision to review and revise its policies and procedures to comply with the HIPAA Privacy Rule. The plan also requires workforce training on the HIPAA right of access and Azul Vision’s policies and procedures.
OCR will monitor Azul Vision’s compliance with the corrective action plan. Azul Vision must also submit reports to OCR covering all right of access requests, including the dates requests were received and the dates the requests were completed.
Enforcement Initiative
The settlement is OCR’s 55th financial penalty issued under its HIPAA Right of Access enforcement initiative. The settlement is OCR’s ninth financial penalty of 2026 to resolve an alleged violation of the HIPAA Rules.
The case concerns the timely provision of requested medical records and the corrective measures required after OCR determined that Azul Vision had not acted within the applicable access timeframe. The corrective action plan establishes requirements for policy review, workforce training, monitoring, and reporting of right of access requests.