Azul Vision, a California eye care provider, has agreed to pay $50,000 to resolve a HIPAA investigation triggered by a single patient’s complaint about slow access to her medical records.
The HHS Office for Civil Rights said the patient filed her complaint in April 2023, three months after requesting a copy of her health information. Under the Privacy Rule, providers have 30 days to produce requested records, with a possible extension, and OCR found the company’s delay fell short of that standard.
The penalty is the 55th under OCR’s Right of Access initiative and the ninth financial settlement the agency has announced in 2026. Along with the payment, Azul Vision must revise its privacy policies, train staff on access requirements, and send OCR regular reports on every records request it handles, including how quickly each was fulfilled. The agency will monitor compliance while the corrective action plan runs.
OCR Director Paula M. Stannard called the action part of a commitment to ensuring patients can get their own health information when they need it. The case is a warning to smaller practices that even a single unanswered records request can trigger a federal investigation, a financial penalty, and years of oversight.
