Cybersecurity Policy Report, Occupational Health Provider Settles With HHS Over HIPAA Violation, (Dec 17, 2025)
The Department of Health and Human Services Office of Civil Rights (OCR) has settled a Health Insurance Portability and Accountability Act (HIPAA) privacy rule investigation with Concentra, Inc., a Texas-based occupational health services provider, over its failure to provide timely access to an individual’s protected health information (PHI) within 30 days.
HIPAA’s privacy rule gives individuals certain rights, including the right to obtain a copy of their health records for a reasonable cost.
An HHS press release explains that the OCR initiated an investigation following its receipt of a complaint by an individual who was denied timely access to the requested health information despite making six requests beginning in February 2018. The individual was able to access the requested health information in March 2019, more than a year after the initial request, in violation of HIPAA’s “Right of Access” provisions which “require that individuals or their personal representatives have timely access to health information within 30 days, with the possibility of one 30-day extension.”
“Concentra failed to take timely action in response to the individual’s right of access requests in accordance with the HIPAA Privacy Rule’s right of access standard,” OCR said.
In June 2021, OCR proposed a civil monetary penalty of $250,000 against Concentra for the violation. Concentra subsequently requested a hearing before an administrative law judge and on May 5, prior to the hearing, Concentra agreed to settle the enforcement action and pay a penalty of $112,500.
News: FederalLegislation DataPrivacy LitigationEnforcement