Today, the US Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced a settlement with Concentra, Inc., an occupational health services provider headquartered in Texas, for a potential violation of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule. The settlement resolves an investigation of a complaint alleging a failure to provide timely access to an individual’s protected health information (PHI). OCR’s investigation determined Concentra failed to provide timely access to an individual’s PHI within 30 days. OCR’s settlement with Concentra marks the 54th enforcement action in OCR’s Right of Access Enforcement Initiative, which OCR initiated during the first term of the Trump Administration. The enforcement action stems from an investigation that OCR initiated after receiving a complaint that an individual was not given timely access to his health information, despite making six requests beginning in February 2018. The individual did not receive access to his health information until March 2019, more than a year after his initial request. OCR’s investigation determined that Concentra failed to take timely action in response to the individual’s right of access requests in accordance with the HIPAA Privacy Rule’s right of access standard.