HHS Office for Civil Rights Imposes a $200,000 Penalty Against Oregon Health & Science University for Failure to Provide Timely Access to Patient Records

FOR IMMEDIATE RELEASE March 6, 2025 Contact: HHS Press Office 202-690-6343 Submit a Request for Comment HHS Office for Civil Rights Imposes a $200,000 Penalty Against Oregon Health & Science University for Failure to Provide Timely Access to Patient Records The civil monetary penalty marks OCR’s 53rd HIPAA Right of Access enforcement action to advance patient access to medical records. Today, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), announced a $200,000 civil monetary penalty against Oregon Health & Science University (OHSU), a public academic health center and research university, for violating an individual’s right to timely access her medical records through a personal representative. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule’s “Right of Access” provisions require that individuals or their personal representatives have timely access to health information requested from a HIPAA covered entity (health plans and most health care providers) within 30 days, with the possibility of one 30-day extension and for a reasonable, cost-based fee. OCR enforces the HIPAA Privacy Rule, which establishes national standards to protect individuals’ medical records; sets limits and conditions on the uses and disclosures of protected health information; and gives individuals certain rights, including the right to timely access and to obtain a copy of their health records. “The HIPAA Privacy Rule requires that individuals and their personal representatives receive timely access to their medical records,” said OCR Acting Director Anthony Archeval. “A covered entity’s responsibility to provide timely access continues, even when a covered entity contracts with a business associate to respond to HIPAA right of access requests.” OCR initiated an investigation of OHSU based on a complaint filed in January 2021 from the individual’s personal representative – the second complaint OCR received on this matter id OCR Acting Director Anthony Archeval. “A covered entity’s responsibility to provide timely access continues, even when a covered entity contracts with a business associate to respond to HIPAA right of access requests.” OCR initiated an investigation of OHSU based on a complaint filed in January 2021 from the individual’s personal representative – the second complaint OCR received on this matter. In September 2020, OCR resolved the first complaint (received in May 2020) when OCR notified OHSU of its potential noncompliance with the Privacy Rule Right of Access provisions. Although OHSU provided part of the requested records in April 2019, OHSU did not provide all of the requested records until August 2021, which was nearly a year after OHSU received OCR’s September 2020 letter, and sixteen months after the first request for records in April 2019. OCR’s investigation found that OHSU failed to take timely action in response to the right of access requests. In September 2024, OCR issued a Notice of Proposed Determination seeking to impose a $200,000 civil monetary penalty. OHSU waived its right to a hearing and did not contest OCR’s imposition of a civil monetary penalty. Accordingly, in December 2024, OCR finalized its determination and imposed the $200,000 civil monetary penalty against OHSU . The Notice of Proposed Determination may be found at: https://www.hhs.gov/sites/default/files/oregon-health-science-university-npd.pdf . The Notice of Final Determination may be found at: https://www.hhs.gov/sites/default/files/oregon-health-science-university-nfd.pdf . OCR is committed to enforcing the HIPAA Rules that protect the privacy and security of peoples’ health information. Guidance about the Privacy Rule , Security Rule , and Breach Notification Rule can also be found on OCR’s website. If you believe that your or another person’s health information privacy or civil rights have been violated, you can file a complaint with OCR at: https://www.hhs.gov/ocr/complaints/index.html orcing the HIPAA Rules that protect the privacy and security of peoples’ health information. Guidance about the Privacy Rule , Security Rule , and Breach Notification Rule can also be found on OCR’s website. If you believe that your or another person’s health information privacy or civil rights have been violated, you can file a complaint with OCR at: https://www.hhs.gov/ocr/complaints/index.html . Follow HHS OCR on X (formerly Twitter) at @HHSOCR. ### Note: All HHS press releases, fact sheets and other news materials are available in our Press Room . Like HHS on Facebook , follow HHS on X @HHSgov , @SecKennedy , and sign up for HHS Email Updates . Last revised: March 19, 2025 Submit a request for comment For media inquiries, please submit a request for comment . Sign up to receive our press releases Sign Up Related Press Releases HHS’ Office for Civil Rights Settles Ransomware Investigation with Healthcare System July 29, 2026 Press Release HHS’ Office for Civil Rights Settles HIPAA Investigation of MMG Fusion, LLC Breach Affecting 15 Million Individuals March 5, 2026 Press Release HHS’ Office for Civil Rights Settles HIPAA Security Rule Investigation with Top of the World Ranch Treatment Center February 19, 2026 Press Release Content last reviewed March 19, 2025