OCR Continues to Focus on Right of Access Obligation and Cyberattacks

On August 27, 2026, the U.S. Department of Health & Human Services, Office for Civil Rights (OCR) announced a settlement resolving its investigation of Azul Vision, Inc. regarding allegations it failed to provide timely access to an individual’s health information within 30 days, as required by HIPAA. The settlement marks the 55th enforcement action in the OCR’s “Right of Access” initiative and demonstrates the OCR’s commitment to enforcing timely access to requested patient information and records.
On September 17, 2026, the OCR announced a settlement of its allegations against Ambry Genetics Corporation of HIPAA violations relating to a successful phishing attack affecting more than 225,000 individuals. Among OCR’s allegations were that the organization failed to conduct an accurate and thorough risk analysis as required by the HIPAA Security Rule, failed to implement procedures for terminating access to electronic protected health information (ePHI) upon employment termination, and failed to assign a unique name and/or number for identifying and tracking user identity in electronic systems housing ePHI.

CLICK HERE TO READ THE FULL OCTOBER 2026 HEALTHCARE LAW UPDATE NOW