What OCR's Right of Access Settlements Say About Getting Your Own Medical Records

The Initiative

In 2019 the Office for Civil Rights (OCR) at the Department of Health and Human Services announced what it called the HIPAA Right of Access Initiative, describing it as a commitment to enforce the right of patients to get their medical records promptly, without being overcharged, and in the format of their choice. It was framed as an enforcement priority rather than a new rule; the underlying obligation at 45 CFR 164.524 has been in place since the Privacy Rule was published in 2000.

The first settlement, announced in September 2019, was with Bayfront Health St. Petersburg, which paid $85,000 after failing to give a mother timely access to records about her unborn child. Korunda Medical, LLC, a Florida primary care and pain management practice, followed as the second case, also at $85,000.

OCR then reported the count publicly as it grew. A 2020 announcement of five more settlements brought the total to seven. A later group of five enforcement actions brought it to twenty-five. When OCR resolved three cases with dental practices in September 2022, it put the running total at 41. Access cases have continued to be resolved since, though OCR stopped numbering them.

What the Regulation Actually Gives a Patient

Section 164.524 gives an individual a right to inspect and obtain a copy of protected health information about them held in a designated record set, for as long as it is maintained there. Two categories sit outside the right entirely: psychotherapy notes, and information compiled in reasonable anticipation of, or for use in, a civil, criminal or administrative proceeding.

The timing provision is the one the settlements turn on. A covered entity must act on a request no later than 30 days after receipt, either by providing the access or by issuing a written denial. It may extend that period by no more than 30 additional days, but only if it gives the individual a written statement of the reasons for the delay and the date by which it will act, and it may take only one such extension.

The regulation also addresses format and cost. If the information is held electronically and an electronic copy is requested, the entity must provide it in the electronic form and format requested where readily producible. If the individual directs the entity in writing to send the copy to a third party, and the request is signed and identifies the person and destination, the entity must send it there. Any fee must be reasonable and cost-based, and may include only labour for copying, supplies, postage where mailing was requested, and preparing an agreed summary or explanation.

The Pattern in the Settlements

Read alongside one another, the published resolution agreements describe the same sequence over and over. Someone asks for records. Nothing happens. Months later they complain to OCR, and the records arrive.

• Health Specialists of Central Florida. The complainant asked for her deceased father's records, delivering the request and supporting Letters of Administration on 29 August 2019. The records were sent on 27 January 2020, roughly five months later. OCR received her complaint in November 2019. Resolution amount: $20,000
• David Mente, MA, LPC, a Pittsburgh psychological practice. OCR received a complaint in December 2017 alleging refusal to provide a parent access to his minor children's records, gave technical assistance in January 2018 and closed the matter; the complaint was later reopened. Resolution amount: $15,000
• Azul Vision, Inc., an optometry and ophthalmology provider operating 31 clinics in California. The complainant requested her records on 9 January 2023. OCR received her complaint that April. The request was not fulfilled until 6 January 2025, nearly two years after it was made. Resolution amount: $50,000

Notably, technical assistance did not end the Mente matter. OCR closed the complaint after providing guidance on the right of access, and the case came back.

The Amounts Are Small by OCR's Standards

Published resolution amounts in access cases have clustered at the low end of OCR's range. The Diabetes, Endocrinology & Lipidology Center, a West Virginia provider, paid $5,000 as OCR's nineteenth access settlement. Children's Hospital & Medical Center in Omaha paid $80,000 as the twentieth. Bayfront and Korunda, at $85,000, remain at the top of the published range.

Set against the multi-million dollar figures OCR has recorded in some breach matters, these are modest sums. What distinguishes the access cases is volume and repetition rather than size, and the fact that each one begins with an individual rather than with a breach report.

Not every access matter is a settlement. In the 2021 group of five, OCR proceeded against one provider, Dr. Robert Glaser, by Notice of Proposed Determination and Notice of Final Determination — the civil money penalty route — rather than by resolution agreement.

What the Corrective Action Plans Require

The resolution agreements attach a corrective action plan, and the plans are close to a template. Taking the Azul Vision plan as the example, its compliance term runs two years from the effective date, and it obliges the entity to:

• Review and where necessary revise its Privacy Rule policies and procedures within 30 days, expressly including the right of access and the cost-based fee it charges
• Distribute those policies to the whole workforce within 60 days and obtain a signed certification from each member that they have read and will abide by them
• Submit to HHS, every 90 days for the life of the plan, a list of every access request received — with the date received, date completed, format requested, format provided, page count and cost
• Train every workforce member on the right of access within 90 days and at least once every 12 months thereafter, and new members within 30 days of starting
• Submit annual reports, and retain documents after the compliance term ends

The quarterly request log is the part with real teeth: for two years the provider reports its handling of every records request to the regulator. The agreements also state that the release HHS gives does not extend to actions under section 1177 of the Social Security Act, 42 U.S.C. 1320d-6, the criminal provision.

How a Complaint Reaches OCR

The mechanics are set out at 45 CFR 160.306. A person who believes a covered entity or business associate is not complying may file a complaint with the Secretary. It must be in writing, on paper or electronically; it must name the entity and describe the acts or omissions believed to violate the rules; and it must be filed within 180 days of when the complainant knew or should have known of the act or omission, unless the Secretary waives that limit for good cause.

The regulation distinguishes two tiers of response. The Secretary will investigate a complaint where a preliminary review of the facts indicates a possible violation due to willful neglect. The Secretary may investigate any other complaint. That discretion is why the Right of Access Initiative mattered: it signalled which complaints in the second category OCR intended to pursue.

The settlements themselves record that closure is not always final. In the Mente matter OCR closed a 2017 complaint after providing technical assistance, and the case was reopened years later.

Frequently Asked Questions