Concentra Inc. decided to resolve a supposed violation of the HIPAA Right of Access with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) by shelling out $112,500 as a financial penalty, even though it challenged OCR’s resolution that there was a HIPAA violation.
The HIPAA Privacy Law gives people rights regarding their protected health information (PHI), which include the right to acquire a copy of their PHI and just pay a fair, cost-based amount. Whenever a HIPAA-covered entity receives a request for a copy of a person’s medical data, the requested information should be given within a month. The records should be furnished in the requested format, assuming the covered entity can provide them in the required format promptly. OCR introduced an enforcement initiative at the end of 2019, aiming to address non-compliance with the HIPAA Privacy Law after receiving many complaints from persons who weren’t given their requested documents when they were due. Including the most recent financial penalty, OCR has issued 54 financial penalties as part of this enforcement initiative.
Concentra located in Addison, Texas, is a HIPAA-covered healthcare provider that is a leader in occupational health. Concentra operates 547 occupational health facilities and 151 onsite health centers at employer worksites in over 40 U.S. states. OCR started an investigation as a result of a complaint received from someone who was not given a copy of his sensitive data, in spite of submitting six requests. Concentra’s Peoria, Arizona, Center got the initial request on February 15, 2018.
The patient requested a digital copy of his clinical and billing data in February 2018. A Concentra staff member sent the access form to Concentra’s Central Billing Office (CBO). The patient provided more requests to the same Peoria office in 2018, and they were at the same time submitted to the CBO, although the information was not made available. On October 8, 2018, OCR confirmed that Concentra’s business associate wrote an invoice for $82.57 to create a copy of the needed records. The invoice was debated, and on March 19, 2019, the payment was changed to a flat price of $6.50, and the information was sent in paper format.
OCR advised Concentra that the investigation found a likely violation of the HIPAA Right of Access for failing to give the documents within 30 days. Concentra replied and questioned the first discoveries of the investigation and filed evidence supporting its position. OCR reacted and suggested a $250,000 financial penalty to take care of the violation, having turned down Concentra’s proof. Concentra asked for the guidance of an Administrative Law Judge to argue the recommended civil monetary penalty. Concentra and OCR then participated in settlement conversations and, on May 5, 2025, before an administrative hearing, the two parties decided to resolve the case by paying a $112,500 financial penalty.
According to the HIPAA Privacy Law, people or their personal representatives promptly access their health records, stated OCR Director Paula M. Stannard. People do not need to make several requests and submit a complaint to OCR to acquire access to their medical information. OCR has been actively implementing compliance with the HIPAA Guidelines in 2025. The Concentra HIPAA fine is OCR’s 21st penalty enforced in 2025 to settle claimed violations of the HIPAA Rules.