By Elizabeth McElhiney, Director of Government Affairs and Policy at Verisma
October 14, 2026
In August, the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced a $50,000 settlement with an ophthalmology practice in California, resolving a potential violation of the HIPAA Privacy Rule.
The complaint originated when a patient reported they hadn’t received a copy of their protected health information (PHI), which was requested on Jan. 9, 2023. According to the OCR notice, the patient didn’t receive the medical records until Jan. 6, 2025. The practice, without admitting liability, also agreed to a two-year corrective action plan requiring the establishment of policies, training, 90-day request-status reporting, and reports when workforce members fail to follow access procedures.
This resolution, which isn’t the first or largest OCR has settled, serves as a reminder of how HHS continues to emphasize a patient’s right of access to their medical information. It’s a clarion call for leaders to evaluate how effective, and HIPAA-compliant, their release of information (ROI processes are.
Providers recognize there’s a direct correlation between right of access and results: informed and involved patients have better clinical outcomes. And to be involved, patients need access to their health information.
The consequences of delayed access range from great inconvenience (e.g., a student can’t be enrolled in a new school, and the parents must stay home from work, because immunization records aren’t available) to horrific (a patient dies after surgery because a provider didn’t receive records on previous complications with anesthesia).
Rarely, of course, do access barriers arise from ill intent. Often, ROI requests lag because the provider lacks the dedicated staff resources or the technology needed to manage the workflow effectively. In other cases, staff may not be fully educated on HIPAA and a patient’s right to timely access. Further, they genuinely might not recognize the initial OCR notification when it comes across their desk after a complaint has been filed and, therefore, fail to act.
Compounding these potential vulnerabilities is the complex and dynamic nature of rules governing right of access. Some individual states, for instance, are currently enacting laws to ensure parents can access information about their children’s healthcare (except in special circumstances). In the past, minors might have been able to receive specific services without their parent’s consent (e.g., birth control, substance abuse treatment, or mental health services). Other states are mandating shorter turnaround times between an ROI request and fulfillment.
This is where Verisma and its proven ROI suite come in. Our solutions deliver superior support for the entire ROI process, streamlining the request and fulfillment ends of the equation. From intake to delivery, Verisma combines proven technology, intelligent automation, and expert oversight via our “human in the loop” approach to manage ROI accurately, efficiently and compliantly – so our clients never have to lose sleep over potential OCR investigations or settlements. Plus, Verisma makes the process less burdensome for patients via the Verisma Request App™. They receive their information faster and more securely.
Our job is to protect patients, providers and organizations, and we’re really good at it! I’m very proud of what our technology and staff can do.
For more information, please visit Verisma.com.
