OCR Right of Access Initiative
HHS Office for Civil Rights' enforcement focus on the patient right of access under 45 CFR 164.524.
1 min read · Last reviewed May 23, 2026
At a glance
- Category
- HIPAA & Privacy
- Primary sources
- 2
- Workspace handoff
- compliance binder →
Where this comes up
Privacy officers and practice managers handle this — patient rights requests, accounting of disclosures, BAA reviews with new vendors, breach risk assessments after an incident, and OCR responses when a complaint lands. The 60-day breach-notification clock starts at discovery, not at investigation close.
Full definition
What it is in practice
Since 2019, OCR has issued more than 40 settlements (typically $10,000-$240,000) for covered entities that failed to provide records within 30 days, charged unreasonable fees, or required in-person pickup. The initiative is the most actively-enforced HIPAA area for small practices.
How it shows up in your practice
Train front-desk and medical-records staff on the 30-day timeline, the reasonable-fee schedule, and the right of patients to receive records by email or other electronic means when readily producible.
Sources
- HHS OCR — Enforcement Highlightshttps://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/data/enforcement-highlights/index.html
- 45 CFR 164.524 — Access of individuals to PHIhttps://www.ecfr.gov/current/title-45/section-164.524
Audit your records-request log in the Compliance Binder
Open compliance binder →Related terms
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- GlossaryPatient Right of AccessThe HIPAA right of an individual to inspect and obtain a copy of their PHI in a designated record set.
- GlossaryHIPAA Privacy RuleThe federal regulation at 45 CFR Part 164 Subpart E that governs the use and disclosure of PHI.
- GlossaryDesignated Record SetThe group of records maintained by or for a covered entity that contains PHI used to make decisions about individuals.
- GlossaryOCR Civil Monetary Penalties (HIPAA)HHS Office for Civil Rights' tiered CMP structure for HIPAA violations, with maximums adjusted annually for inflation.
- RegulationHIPAA Accounting of Disclosures (45 CFR 164.528)Individuals may request an accounting of disclosures of their PHI made by a covered entity in the prior six years, with a defined list of exclusions.
- RegulationHIPAA Privacy Rule Administrative Requirements (45 CFR 164.530)Designated privacy official, workforce training, safeguards, complaint process, sanctions, mitigation, anti-retaliation, anti-waiver, documentation, and policies and procedures.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
- SRAHIPAA Patient Right of Access: A Small-Practice WalkthroughHow 45 CFR 164.524 governs patient access to their records, the 30-day rule and 30-day extension, the limited fees a practice may charge, and the OCR Right of Access Initiative.
This glossary entry is a research aid for billing and compliance staff. It does not provide legal, medical, or financial advice and does not replace counsel. References cited link to primary sources at HHS, OCR, CMS, eCFR, NIST, and the relevant payer or industry body.