The Conventional Wisdom
When the OCR announces another right-of-access settlement, compliance officers often react predictably: update the access policy, schedule training, and document everything. The message seems clear: if you're not processing every request within 30 days, you're risking enforcement.
This interpretation isn't entirely wrong, but it's incomplete. It wastes resources and misses the real lesson.
Why It's Incomplete
The Azul Vision settlement tells a different story. Yes, the California eye care provider paid $50,000 after a patient waited nearly two years for records requested on January 9, 2023. Yes, OCR found a potential violation of 45 CFR § 164.524(b). And yes, Azul Vision now submits quarterly reports tracking every access request.
But here's what matters more: the records weren't provided until January 6, 2025, after OCR had already begun investigating. This wasn't a 45-day delay that triggered enforcement. It was a complete breakdown that required regulatory intervention.
Most compliance programs treat every late response as equally risky. They build elaborate tracking systems, assign dedicated staff, and conduct monthly audits to shave days off average response times. Meanwhile, the actual risk pattern is binary: you either respond, or the request falls into a void until someone complains to OCR.
The corrective action plan Azul Vision accepted requires 90-day reporting of request dates, response dates, formats, page counts, fees, and denials. That's the compliance infrastructure you need after you've shown you can't handle the basic function of responding to patients. It's remedial oversight, not a necessary practice for everyone.
The Evidence
Look at the enforcement pattern OCR Director Paula M. Stannard referenced when she noted this was "OCR's 55th enforcement action in the Right of Access Initiative." These cases share a common thread: they involve requests that weren't just late, they were abandoned.
Phoenix Healthcare took 323 days to provide records to a patient's daughter acting as a personal representative. OCR initially sought $250,000, an administrative law judge found willful neglect and reduced it to $75,000, and the parties settled at $35,000. That's not about missing a 30-day deadline. It's about ignoring a request until enforcement pressure forced action.
Optum Medical Care paid $160,000 after six complaints involving delays ranging from 84 to 231 days. Again, these weren't marginal timing failures. They were systematic non-responses.
The Privacy Rule's actual requirement is straightforward: act on the request within 30 days by providing the information or issuing a written denial. You get one 30-day extension if you notify the individual in writing within the original deadline, explain the delay, and provide a completion date. That's it. The rule doesn't require perfect 30-day turnaround. It requires timely communication and good-faith effort.
What to Do Instead
Stop building compliance programs around the assumption that every late response triggers equal risk. Instead, focus on three failure modes that actually draw enforcement:
Complete Non-response. If a request sits in someone's inbox for months without acknowledgment, you're in the danger zone. Build a simple intake system that confirms receipt within 72 hours and assigns responsibility. It doesn't need to be sophisticated; it needs to be reliable.
Extension Abuse. If you're routinely taking the 30-day extension without legitimate reasons, or if you're notifying patients of extensions after the original deadline has passed, you're violating the rule's intent. Use extensions sparingly and document the specific reason (unusual volume, off-site storage, format conversion challenges).
Post-Complaint Inaction. The Azul Vision records were provided after OCR initiated its investigation. If you receive a patient complaint about access and don't immediately escalate and resolve it, you're demonstrating the kind of willful neglect that administrative law judges recognize.
Your compliance energy should go toward ensuring no request disappears, not toward optimizing average response time from 28 days to 25 days. Track three metrics: percentage of requests acknowledged within five business days, percentage requiring extensions, and percentage resolved without escalation to your Privacy Official. If those numbers look good, you're managing the actual risk.
For corrective action plan requirements like quarterly reporting of every request detail, save that overhead for organizations that have already failed. If you're responding to requests in good faith and resolving complaints promptly, you don't need that administrative burden.
When the Conventional Wisdom Is Right
If your organization regularly receives high volumes of complex requests, manages records across multiple systems, or has already received an OCR complaint about access, then yes, formalize everything. Document your process, train your staff quarterly, and track metrics that prove consistent performance.
The conventional wisdom also holds when dealing with particularly sensitive requests: personal representatives who may not have proper authorization, requests for psychotherapy notes that have different access rules, or situations where you're considering denial based on endangerment concerns under 45 CFR § 164.524(a)(3). In those cases, careful documentation and timely communication aren't just good practice; they're essential protection.
But for most covered entities handling routine access requests, the lesson from Azul Vision isn't "track everything obsessively." It's "don't let requests fall through the cracks for two years." That's a simpler standard, and it's the one OCR is actually enforcing.
