HHS’ Office for Civil Rights Settles HIPAA Right of Access Investigation with Azul Vision, Inc.

Settlement Marks OCR's 55^th HIPAA Right of Access Enforcement Action to Advance Individual Access to Medical Records

WASHINGTON — August 27, 2026 — The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) today announced a settlement with Azul Vision, Inc. (Azul Vision), a California-based healthcare provider offering optometry and ophthalmology services, for a potential violation of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule.

The settlement resolves an investigation of a complaint alleging a failure to provide an individual with timely access to her protected health information (PHI). OCR’s investigation determined that Azul Vision failed to provide timely access to an individual’s PHI within 30 days. OCR’s settlement with Azul Vision marks the 55^th enforcement action in OCR’s Right of Access Enforcement Initiative, which OCR began during the first term of the Trump Administration.

“OCR’s 55^th enforcement action in the Right of Access Initiative demonstrates the Trump Administration’s commitment to enforcing timely access to requested protected health information,” said OCR Director Paula M. Stannard. “The right of access is key to empowering individuals to take control of their own health. It should not be necessary for OCR to initiate a right of access investigation before a covered entity will provide an individual with access to their requested records.”

The settlement resolves an investigation that OCR initiated after receiving a complaint in April 2023 alleging that Azul Vision failed to provide an individual with timely access to her PHI following a request in January 2023. The individual did not receive access to her health information until January 2025, almost two years after her initial request, and after OCR initiated this investigation. OCR determined that Azul Vision potentially failed to take timely action in response to the individual’s right of access requests in accordance with the HIPAA Privacy Rule’s right of access standard.

The HIPAA Privacy Rule’s “Right of Access” provisions require that individuals, or their personal representatives, have timely access to health information within 30 days, with the possibility of one 30-day extension. OCR enforces the HIPAA Privacy Rule, which establishes national standards to protect individuals’ health records; sets limits and conditions on the uses and disclosures of PHI; and gives individuals certain rights, including the right to timely access and to obtain a copy of their health records for a reasonable cost.

Under the terms of the resolution agreement, Azul Vision agreed to implement a corrective action plan that OCR will monitor for two years and paid $50,000 to OCR. Under the corrective action plan, Azul Vision has committed to taking steps to ensure compliance with the HIPAA Privacy Rule and to ensure individuals receive timely access to their health records, including:

• Review, and revise, as necessary, written policies and procedures to comply with the Privacy Rule;
• Regularly submit to HHS a list of requests for access to PHI received by Azul Vision, including the date the request was received and the date the response to the request was completed; and
• Ensure that all workforce members are trained with respect to right of access and Azul Vision’s policies and procedures implementing the right of access.

View the resolution agreement and corrective action plan.

OCR is committed to enforcing the HIPAA Rules that protect the privacy and security of people’s health information. Guidance about the Privacy Rule, Security Rule, and Breach Notification Rule can be found on OCR’s website. OCR guidance on parental access to minor children’s protected health information can also be found on OCR’s website.

If you believe that your or another person’s health information privacy or civil rights have been violated, you can file a complaint with OCR.

Follow HHS OCR on X at @HHSOCR.