OCR’s 55th right-of-access penalty: the 30-day clock Colorado PI firms should be using

On August 27, 2026, the HHS Office for Civil Rights settled with a California eye-care provider for $50,000 after a patient waited almost two years for her own records. It is OCR’s 55th right-of-access enforcement action. For a Colorado personal injury firm, the lesson is not the fine. It is that the patient’s own access request carries a federal 30-day deadline, and most attorney records requests never use it.

What the case says

The facts from the resolution, as reported by Hall Render (https://hallrender.com/2026/09/01/ocr-reaches-55th-hipaa-right-of-access-settlement/):

Event	Date
Patient submits records request	January 2023
Patient files complaint with OCR	April 2023
Provider finally delivers records	January 2025
OCR announces settlement	August 27, 2026

Terms: $50,000, a corrective action plan, and two years of OCR monitoring with regular reporting. The provider offered optometry and ophthalmology services. It was not a hospital system, and the delay was not a dispute over fees. It was a records department that did not respond.

Fifty-five actions since the initiative began in 2019 is not a high number. It is enough that every hospital compliance office knows the rule, and that is what makes the rule useful to a plaintiff’s firm.

Two kinds of request, one of them has a deadline

Most PI records requests go out under a HIPAA authorization signed by the client (45 CFR 164.508). That makes the disclosure permitted. It does not make it required, and federal law sets no response time for it. Colorado adds nothing here: C.R.S. 25-1-802 gives the patient and the patient’s representative the right to inspect and copy records and bars any charge for inspection, but it names no number of days (https://colorado.public.law/statutes/crs_25-1-802).

The patient’s own access request under 45 CFR 164.524 is different:

• The provider must act within 30 calendar days of receiving the request.
• One 30-day extension is allowed, and only if the provider tells the patient in writing, inside the first 30 days, why it needs more time and when it will deliver.
• The patient may direct the copy to a third party of their choosing, including their lawyer, in writing, signed, identifying the recipient.
• Records must come in the form and format the patient asks for if the provider can readily produce it, which for an electronic chart means electronic.

The request the OCR case punished was a plain patient request. The clock ran from the day it arrived. Nothing about a PI file changes that.

The fee catch, and Colorado’s answer to it

Under 164.524 a provider may charge the patient only a reasonable, cost-based fee for a copy. Until 2020 HHS guidance extended that patient-rate cap to copies the patient directed to a third party. Ciox Health v. Azar (D.D.C. January 2020) vacated that extension. Today a provider may bill a patient-directed copy sent to a law firm at its normal third-party rates.

In Colorado, “normal rates” are still bounded:

• C.R.S. 25-1-801 sets the per-page schedule for attorney requests ($18.53 for the first 10 pages, then per-page tiers).
• Since August 12, 2026, an attorney request over 664 pages is capped at $400 under HB26-1414, with a redaction exception. The mechanics are in our guide at https://verodi.ai/guides/colorado-hb26-1414-records-fee-cap/.

So the trade is clear. A patient-directed access request buys the 30-day clock and OCR’s complaint process. It does not buy a cheaper invoice. The fee schedule and the cap protect the invoice either way.

What to do in your file

1. Send both forms on day one. A signed HIPAA authorization to the provider, and a signed patient access request under 164.524 directing the copy to the firm. The second one starts the clock. Keep the date of receipt: fax confirmation, certified mail return, or portal timestamp.
2. Calendar day 30 and day 60. If nothing arrives by day 30 and no written extension notice came, the provider is already out of compliance. Day 60 is the outer limit even with the extension.
3. On day 31, write once, plainly. Cite 45 CFR 164.524(b)(2), quote the date the request was received, and ask for the records or the written extension. Send it to the privacy officer, not the ROI clerk. Keep the letter to one page.
4. On day 61, file with OCR. The complaint portal is https://www.hhs.gov/ocr/complaints/. It takes about ten minutes. Most providers produce within days of an OCR inquiry, because the alternative is a resolution agreement like the one above. File it as the patient’s complaint, with the patient’s signature, since the right belongs to them.
5. Check the invoice against the statute. Attorney-rate billing on a patient-directed request is lawful after Ciox, but the 25-1-801 schedule and the $400 cap still apply to the total.

One caution. The right of access covers the designated record set: medical records, billing records, and anything used to make decisions about the patient. It does not reach psychotherapy notes or material prepared for litigation. If a provider withholds a category, ask them to name the exception in writing.

What this means for the file

Two clocks, tracked by hand, on every provider on every case, is where files slip. SettleStack by Verodi sends the request the day the case opens, records the receipt date, and follows up on a schedule with the cite already in the letter, so day 31 happens without anyone remembering it. The statute does the rest.

Sources

• Hall Render, “OCR Reaches 55th HIPAA Right of Access Settlement” (Sept. 1, 2026): https://hallrender.com/2026/09/01/ocr-reaches-55th-hipaa-right-of-access-settlement/
• 45 CFR 164.524, access of individuals to protected health information: https://www.ecfr.gov/current/title-45/section-164.524
• C.R.S. 25-1-802, patient records in custody of health care facilities: https://colorado.public.law/statutes/crs_25-1-802
• C.R.S. 25-1-801, fees for copies: https://colorado.public.law/statutes/crs_25-1-801
• HHS OCR complaint portal: https://www.hhs.gov/ocr/complaints/