Concentra Pays $112,500 After Patient Made Six Records Requests Over 13 Months

Some HIPAA enforcement cases are complicated. The Concentra case is not. A patient asked for his records. He asked six times. He waited more than a year. He filed a complaint with OCR. Seven years later Concentra paid $112,500.

That is the entire story — and it is one that plays out in healthcare organizations every week.

What happened

OCR announced a settlement with Concentra Inc., an occupational health services provider headquartered in Texas, on December 16, 2025. The settlement resolved an investigation of a complaint alleging a failure to provide timely access to an individual's protected health information. The enforcement action stems from an investigation that OCR initiated after receiving a complaint that an individual was not given timely access to his health information, despite making six requests beginning in February 2018. The individual did not receive access to his health information until March 2019, more than a year after his initial request.

OCR's investigation determined that Concentra failed to take timely action in response to the individual's right of access requests in accordance with the HIPAA Privacy Rule's right of access standard.

The timeline of the case is instructive:

• February 2018 — Patient makes first records request
• March 2019 — Patient finally receives access, 13+ months later
• 2019 — Patient files complaint with OCR
• June 29, 2021 — OCR issues Notice of Proposed Determination proposing a civil money penalty
• 2021-2025 — Concentra requests administrative law judge hearing; case proceeds
• May 5, 2025 — Parties resolve prior to administrative hearing; Concentra pays $112,500
• December 16, 2025 — OCR publicly announces the settlement as its 54th Right of Access enforcement action

This settlement marks OCR's 54th HIPAA Right of Access enforcement action to advance individual access to medical records.

The six requests problem

The most striking detail in this case is not the penalty amount or the resolution timeline — it is the six requests.

Under HIPAA a covered entity must respond to a written records request within 30 days. One 30-day extension is permitted with written notice to the patient. That is the legal framework: 30 days, with one extension, for a total maximum of 60 days.

In the Concentra case a patient made six separate requests over 13 months — suggesting that each request was either ignored, lost, or improperly processed, triggering the patient to try again. This is not a close legal question about the scope of the right of access or the permissible grounds for denial. It is a process failure — a covered entity that did not have a functioning records request system.

What OCR's Right of Access Initiative has become

OCR launched the Right of Access Initiative in 2019 with a stated goal of enforcing patients' fundamental right to access their own health information. Six years and 54 enforcement actions later the initiative has become one of OCR's most active and sustained enforcement programs.

The pattern across those 54 cases reveals consistent themes: patients who had to request records multiple times, excessive fees that discouraged access, responses that exceeded the 30-day deadline without proper extension notices, and outright denials without legally recognized grounds.

Penalties across the 54 cases have ranged from $3,500 to $240,000 — with most falling in the $20,000 to $100,000 range. The $112,500 Concentra settlement is on the higher end, reflecting the egregious nature of a 13-month delay and six separate requests.

The seven-year investigation cost

The Concentra case also illustrates a less-discussed cost of HIPAA enforcement: the investigation itself.

OCR initiated this investigation in 2019. The case was not resolved until May 2025 — six years later. During that period Concentra was managing an active OCR investigation, responding to document requests, and eventually engaging in administrative law judge proceedings before agreeing to settle prior to the hearing.

The legal costs of defending a multi-year OCR investigation — attorney fees, compliance consultant fees, staff time, document production — frequently exceed the settlement amount. An organization that settles for $112,500 may have spent significantly more than that on the defense.

This is the math that makes proactive right of access compliance investment straightforward: a functioning records request process costs far less than six years of OCR investigation management.

Building a records request process that works

The Concentra case is a systems failure, not a knowledge failure. The legal requirement — respond within 30 days, charge only reasonable fees, do not deny without legal grounds — is not complicated. What breaks down is the operational process for receiving, tracking, and fulfilling requests.

Every covered entity needs four things:

1. A designated intake point. Every records request — regardless of how it arrives (in person, by mail, by phone, through a patient portal) — must be captured in a central log the moment it is received. The 30-day clock starts at receipt, not at the point someone processes the request.

2. A deadline tracking system. Whether it is a spreadsheet, a ticketing system, or a dedicated compliance platform, every pending records request must have a visible deadline that is actively monitored. Requests cannot fall through the cracks.

3. A clear escalation path. When a request approaches its deadline without being fulfilled, there must be an escalation path — someone who is alerted and responsible for ensuring the request is completed or that a proper extension notice is sent.

4. Documentation of fulfillment. Keep proof of every response: what was sent, when, to whom, and how. If OCR investigates, you need to be able to produce this documentation for every request in the relevant period.