HIPAA Radar tracks publicly disclosed enforcement actions, settlements, corrective action plans, and penalty decisions under the Health Insurance Portability and Accountability Act (HIPAA). Its purpose is to provide a clear, practical view of how U.S. regulators enforce healthcare privacy and security obligations in real cases.
The radar brings together key information on enforcement trends, including the regulator, the covered entity or business associate involved, the financial penalty or settlement amount, the legal basis of the violation, and the core compliance failures identified in each matter. By presenting these cases in one place, HIPAA Radar helps privacy, legal, compliance, and security teams better understand which weaknesses most often lead to regulatory scrutiny and enforcement.
More than a list of enforcement outcomes, HIPAA Radar is designed as a working compliance resource. It shows how regulators approach issues such as risk analysis, access controls, business associate agreements, impermissible disclosures, breach notification, workforce training, and safeguards for protected health information. This makes it easier to translate enforcement activity into practical lessons for internal compliance programs, privacy governance, and healthcare risk management.
Azul Vision, Inc.
Penalty:
$50 000
Failure to provide timely access to protected health information (PHI) under the HIPAA Privacy Rule Right of Access standard.
Core issue:
27 sierpnia 2026
Date
Main public findings:
Cause of the violation:
Description of events
Recommendations:
Source:
Failure to maintain an effective process for timely handling, tracking, and completion of individual requests for access to protected health information. The corrective action requirements indicate deficiencies in access-request governance, workforce procedures, monitoring, and training. OCR did not expressly identify a single underlying root cause.
On January 9, 2023, an individual requested access to her protected health information from Azul Vision. After the request remained unfulfilled, a complaint was filed with OCR on April 27, 2023. Azul Vision did not provide the requested PHI until January 6, 2025, almost two years after the original request. OCR determined that the delay potentially violated 45 C.F.R. § 164.524(b), which requires covered entities to provide timely access to PHI in a designated record set. The matter was resolved through a $50,000 settlement and a two-year corrective action plan.
Establish a centralized and documented process for receiving, logging, assigning, tracking, escalating, and closing PHI access requests; monitor statutory response deadlines and document any permitted extension; periodically review access-request metrics and overdue cases; maintain written HIPAA Right of Access policies, including applicable fee rules; train relevant workforce members and obtain documented acknowledgement of the procedures; investigate and remediate failures promptly; and retain evidence demonstrating timely completion of each request.
