The healthcare provider agreed to a monetary resolution after a patient waited months for the requested records.
The U.S. Department of Health and Human Services Office for Civil Rights reached a settlement with Concentra Inc. to resolve an alleged violation of the HIPAA Right of Access. The OCR stated that the case stemmed from a complaint filed by a patient who made multiple requests for copies of medical and billing records that were not provided within the required timeframe. According to the OCR, the investigation found that Concentra failed to deliver the records within thirty days, as required by the HIPAA Privacy Rule.
The HIPAA Privacy Rule gives individuals the right to obtain copies of their protected health information in a timely manner and in the format requested when readily producible. The OCR launched a focused enforcement initiative in 2019 after receiving repeated complaints from patients who experienced delays or excessive fees when requesting records. In the Concentra case, the patient made multiple requests over an extended period before receiving paper records, despite requesting an electronic copy. OCR concluded that the delay constituted a potential violation, even though the provider disputed the agency’s findings.
The OCR’s Director, Paula Stannard, said individuals should not be required to make repeated requests or file complaints to access their own medical information. She stated that timely access to records is a core patient right under the Privacy Rule. Concentra contested the OCR’s conclusions during the investigation but ultimately agreed to resolve the matter through a settlement prior to an administrative hearing. The OCR said the resolution reflects its continued focus on enforcing patient access requirements.
The OCR has repeatedly said that access to health records is not a courtesy but a legal right. HHS has outlined that providing timely access “empowers individuals to be more in control of decisions regarding their health and well-being,” allowing patients to monitor conditions, follow treatment plans, and identify errors in their records. With most health information now stored electronically, the agency has made clear that patients should not face unnecessary delays or repeated requests to obtain their own data. Enforcement actions like the Concentra settlement reflect OCR’s view that access failures undermine patient trust and run counter to HIPAA’s long-standing goal of putting individuals “in the driver’s seat” of their healthcare decisions.
It gives patients the right to obtain copies of their protected health information within thirty days of a request, subject to limited exceptions.
Yes. When records are maintained electronically, covered entities must provide them in electronic form if readily producible.
They may charge only reasonable, cost-based fees, and excessive or unexplained charges can violate the Privacy Rule.
Delayed access can affect continuity of care, insurance claims, and patient decision-making, making it a recurring source of complaints.
They can standardize intake workflows, track request deadlines, limit internal handoffs, and audit response times for both paper and electronic records.