OCR settles its 55th right of access case for $50,000 over a records request that took two years
Sep 27, 2026 edition · GC-2026-0005 · Published 2026-09-27 · Version 2 · Settled
Azul Vision’s $50,000 HIPAA resolution concerns a records request fulfilled almost two years after submission. The agreement covers a 31-clinic provider and imposes a two-year corrective action plan. Its August 13 effective date and case-specific monitoring clocks are distinct from the August 27 announcement.
What happened
OCR announced its 55th HIPAA Right of Access enforcement action on August 27, resolving a complaint involving Azul Vision, a California optometry and ophthalmology provider operating 31 clinics. The individual requested records on January 9, 2023, complained to OCR on April 27, and did not receive them until January 6, 2025. OCR identified a potential failure to provide timely access, while the agreement expressly disclaims an admission of liability. HHS’s release reports a $50,000 payment and a two-year corrective action plan. Azul signed on August 12 and HHS on August 13; the agreement becomes effective on the last signature, establishing August 13 as the resolution date rather than the later announcement.
The corrective plan requires a policy review within 30 calendar days, distribution within 60 days, and workforce training within 90 days and at least annually thereafter. It also requires recurring 90-day submissions listing access requests and response dates, annual reports, and retention of compliance records for six years. These are Azul’s negotiated duties, not automatic new reporting obligations imposed on every covered entity. The broader operational issue is whether a provider can follow a request from intake to actual delivery and detect unresolved cases before external intervention. The historical dates distinguish the underlying delay, agreement and public announcement without suggesting a new complaint or later outcome.
Scope and timing
- Authority status
- Settled
- Applicability
- Directly applicable
- Audience
- Health systems, Provider networks
- Jurisdiction
- Federal, California
Why it matters
A multi-clinic specialty provider needs a request-tracking process that can identify prolonged delays across locations. The corrective plan makes intake dates, completion dates, training and oversight observable; it does not create a universal Azul-specific reporting duty.
Recommended action
Privacy leaders should test request intake, escalation, completion evidence and any extension documentation against applicable access requirements. Compare local training and overdue-request monitoring with the practical controls described in this case. Do not apply Azul’s negotiated reporting dates to unrelated organizations.
Case details
- agencies
- HHS Office for Civil Rights
- entities
- Azul Vision, Inc.
- action Type
- Resolution agreement
- event Date
- 2026-08-13
- alleged Conduct
- Potential failure to provide timely access to PHI requested January 9, 2023; fulfilled January 6, 2025 after an April 27, 2023 complaint. The agreement is not an admission of liability.
- resolution
- $50,000 payment reported by HHS and two-year CAP. Azul signed August 12 and HHS August 13, 2026; last-signature effective date August 13; public announcement August 27.
Operational lessons
- Track each access request through actual fulfillment and retain response-date evidence.
- Escalate unresolved requests across all clinic locations.
- Distinguish generally applicable access requirements from case-specific CAP training/reporting clocks.
Sources
- HHS Office for Civil Rights Settles HIPAA Right of Access Investigation with Azul Vision, Inc.Official · HHS Office for Civil Rights · 2026-08-27 · Source review 2026-09-06
- Resolution Agreement and Corrective Action Plan with Azul Vision, Inc.Official · HHS Office for Civil Rights · 2026-08-27 · Source review 2026-08-31
Complete edition and supplemental material
This finding in the complete approved report →Regulatory horizons, CIA trends and implementation trackers remain in the full report.
Read the entire Enforcement Briefing report →