OCR Settles with California Eye Care Provider Azul Vision for Failure to Provide Timely Patient Record Access — 55th Right of Access Enforcement Action

OCR has now reached 55 settlements under its Right of Access Initiative, and the latest target is not a large hospital network or a major insurer. It is a California-based optometry and ophthalmology practice.

On August 27, 2026, the HHS Office for Civil Rights announced a settlement with Azul Vision, Inc., resolving an investigation into the provider's failure to give a patient timely access to her protected health information. The case is a direct reminder that no covered entity, regardless of size or specialty, sits outside OCR's enforcement reach on this issue.

What Happened

OCR's investigation found that Azul Vision failed to provide an individual with her protected health information within the timeframe HIPAA requires. Under the Right of Access rule, covered entities must act on a patient's records request within 30 calendar days. A single 30-day extension is available, but only if the entity notifies the patient in writing before the original deadline passes.

Failing to meet that deadline is not a paperwork technicality. It is a direct violation of a patient's federally protected right to access her own health data, and OCR has made clear through 55 consecutive enforcement actions that it will pursue these violations.

Terms of the Settlement

The resolution agreement includes a corrective action plan that OCR will monitor going forward. The CAP requires Azul Vision to take specific remedial steps to close the compliance gaps OCR identified. The details of any monetary component have not been independently confirmed beyond what OCR has disclosed in its press release, so readers should consult the source directly for the most current settlement terms.

Why the 55th Action Matters

The Right of Access Initiative began during the first Trump Administration and has continued across administrations, signaling that this enforcement priority has bipartisan durability. Reaching 55 settlements is not a plateau. It is a signal that OCR has built institutional momentum around this issue and is not slowing down.

Several patterns are visible across the initiative:

• Small and specialty practices are consistent targets. Eye care clinics, dental offices, and independent physician groups have all appeared in the settlement list. Size does not confer protection.
• The violation type is usually straightforward. Most cases involve a patient making a clear, documented request and the provider failing to respond within the legal window. There is rarely ambiguity about whether the request was made.
• Corrective action plans extend OCR's oversight. A settlement does not close the file. It opens a monitoring period during which the covered entity must demonstrate sustained compliance. A lapse during that window can trigger additional scrutiny.

What Compliance Officers Should Do Now

Use this settlement as a trigger for a focused internal review. The questions to answer are practical and specific.

Does your team know the 30-day clock starts on receipt of the request, not on the date someone reads it? Any gap between receipt and routing can silently erode the response window.

Do you have a log of all active records requests and their deadlines? Manual tracking in email threads or paper forms is a common failure point. A centralized log with deadline alerts is a minimum standard.

Have you documented your extension procedure? If your practice needs the optional 30-day extension, the written notice to the patient must go out before the original deadline, not after. Missing that notice forfeits the extension.

Does your staff know what counts as a valid request? Patients do not need to use specific legal language. A clear request for their own records, in whatever form it arrives, starts the clock.

Are business associates who handle records on your behalf covered by your policies? If a third-party health information management vendor is involved in fulfilling requests, your BAA and internal oversight should address turnaround time accountability.

The Broader Compliance Takeaway

The Azul Vision settlement reinforces a pattern that has now played out 55 times. OCR is not treating Right of Access enforcement as an occasional signal. It is a sustained, monitored program with a documented track record of reaching providers across every specialty, size category, and geography.

For practices that have not recently audited their patient records access workflow, the question is not whether OCR is watching this issue. The question is whether your process would hold up if a single patient complaint triggered a review.