The healthcare provider agreed to a monetary resolution after a patient waited months for the requested records.
What happened
The U.S. Department of Health and Human Services Office for Civil Rights reached a settlement with Concentra Inc. to resolve an alleged violation of the HIPAA Right of Access. The OCR stated that the case stemmed from a complaint filed by a patient who made multiple requests for copies of medical and billing records that were not provided within the required timeframe. According to the OCR, the investigation found that Concentra failed to deliver the records within thirty days, as required by the HIPAA Privacy Rule.
Going deeper
The HIPAA Privacy Rule gives individuals the right to obtain copies of their protected health information in a timely manner and in the format requested when readily producible. The OCR launched a focused enforcement initiative in 2019 after receiving repeated complaints from patients who experienced delays or excessive fees when requesting records. In the Concentra case, the patient made multiple requests over an extended period before receiving paper records, despite requesting an electronic copy. OCR concluded that the delay constituted a potential violation, even though the provider disputed the agency’s findings.
What was said
The OCR’s Director, Paula Stannard, said individuals should not be required to make repeated requests or file complaints to access their own medical information. She stated that timely access to records is a core patient right under the Privacy Rule. Concentra contested the OCR’s conclusions during the investigation but ultimately agreed to resolve the matter through a settlement prior to an administrative hearing. The OCR said the resolution reflects its continued focus on enforcing patient access requirements.
The big picture
The OCR has repeatedly said that access to health records is not a courtesy but a legal right. HHS has outlined that providing timely access “empowers individuals to be more in control of decisions regarding their health and well-being,” allowing patients to monitor conditions, follow treatment plans, and identify errors in their records. With most health information now stored electronically, the agency has made clear that patients should not face unnecessary delays or repeated requests to obtain their own data. Enforcement actions like the Concentra settlement reflect OCR’s view that access failures undermine patient trust and run counter to HIPAA’s long-standing goal of putting individuals “in the driver’s seat” of their healthcare decisions.
FAQs
What is the HIPAA Right of Access?
It gives patients the right to obtain copies of their protected health information within thirty days of a request, subject to limited exceptions.
Does the rule apply to electronic records?
Yes. When records are maintained electronically, covered entities must provide them in electronic form if readily producible.
Can providers charge fees for records?
They may charge only reasonable, cost-based fees, and excessive or unexplained charges can violate the Privacy Rule.
Why does the OCR prioritize access cases?
Delayed access can affect continuity of care, insurance claims, and patient decision-making, making it a recurring source of complaints.
How can providers reduce access-related risk?
They can standardize intake workflows, track request deadlines, limit internal handoffs, and audit response times for both paper and electronic records.
Farah Amod
