What happened
On August 27, 2026, the HHS Office for Civil Rights announced a settlement with Azul Vision, Inc., a California based provider of optometry and ophthalmology services. HHS counted the matter as its 55th action under the Right of Access Enforcement Initiative.
According to the release, an individual made a records request in January 2023 and filed a complaint with OCR in April 2023. The release says she did not receive access to her health information until January 2025, after OCR had opened its investigation. OCR stated that its investigation determined Azul Vision failed to provide timely access to the individual’s PHI within 30 days. The release frames the matter as a potential violation of the HIPAA Privacy Rule.
Azul Vision paid $50,000 to OCR and agreed to a corrective action plan that OCR will monitor for two years. The release does not say whether Azul Vision admitted liability, and we are not characterizing it either way.
Analysis: The number that matters here is 30 days, because that is the yardstick OCR applied. In this matter the gap between the request and the records was about two years, and the clock did not stop the complaint from being filed in the meantime. For an ABA clinic, the practical lesson is about tracking, not about any one request: someone should own the date a request arrives, the date it is due, and the date it was fulfilled, so that a request sitting in an inbox does not age quietly. Requests also do not always look like formal requests, so staff who answer the phone and the portal should know to route them. This is reporting, not legal advice.
About the settlement figure: it is the amount paid to OCR. It does not include the entity's own costs of responding, such as staff time, outside advisers and remediation, or any private claims.
Compliance you can actually show.
WiseUpHIPAA is built for ABA clinics. It works out what applies to you, holds your decisions and the evidence behind them, and shows you honestly where you stand, including the parts that are not done yet.