The question at hand
Your patient portal logs a records request at 9 a.m. By 9:15, it's in someone's email inbox. By lunch, it's been forwarded twice. By day 30, you're scrambling to figure out who owns it. This isn't a technology problem. It's an organizational design question that splits healthcare compliance teams into two camps: centralize all Data Subject Access Requests through a single intake point, or distribute responsibility to the departments that hold the records.
The stakes are real. Azul Vision Inc. settled with the HHS Office for Civil Rights for $50,000 after a patient waited two years for records she requested in January 2023. The complaint reached OCR three months after the initial request. The records arrived in January 2025. This was OCR's 55th enforcement action under its HIPAA Right of Access initiative, and the pattern is clear: when responsibility diffuses across departments, requests fall through organizational cracks.
The HIPAA Privacy Rule requires covered entities to respond to access requests within 30 days, with one possible 30-day extension under specific circumstances. But the rule doesn't dictate how you organize internally to meet that deadline. That's where the debate begins.
The case for centralized intake
Centralization advocates argue that a single point of accountability prevents exactly what happened at Azul Vision. When one team owns every incoming request, tracks every deadline, and escalates every delay, you eliminate the coordination failures that turn 30-day obligations into multi-year embarrassments.
A centralized model typically routes all requests through your privacy office or a dedicated patient access team. They log the request, assign a tracking number, determine which departments hold responsive records, set internal deadlines with buffer time, and monitor completion. The requesting patient communicates with one contact. Your audit trail lives in one system.
This structure makes corrective action plans easier to execute. When OCR requires you to "review and revise policies and procedures" and "submit reports of all right of access requests, including the date the requests were received and the completion dates," you're pulling from a single source of truth. Your training becomes consistent because everyone follows the same intake protocol. Your metrics are clean because you're not reconciling spreadsheets from radiology, billing, and primary care.
Centralization also addresses the knowledge gap problem. Not every department head understands that the 30-day clock starts when the request arrives anywhere in your organization, not when it reaches the department that holds the records. A specialized team builds deep expertise in HIPAA Privacy Rule requirements, fee calculations, redaction standards for third-party information, and the narrow circumstances that permit extensions.
The case for distributed responsibility
Decentralization proponents counter that centralized teams become bottlenecks. They argue that the people closest to the records respond fastest. Your radiology department knows which images correspond to which dates. Your lab knows how to pull test results from legacy systems. Your billing team understands the chart notes that explain procedure codes. Routing everything through a central office adds handoffs, translation layers, and delays.
Distributed models assign intake responsibility to the department that received the initial request. If a patient asks her oncologist's office for treatment records, that office owns the response. The privacy office provides tools, templates, and escalation support but doesn't insert itself into every transaction. Advocates argue this scales better as your organization grows and request volume increases.
This approach also aligns responsibility with capability. The department that created the records has the clinical context to identify what's responsive, what requires redaction, and what needs explanation. They can answer follow-up questions without playing telephone through a central coordinator. When requests are straightforward, they're fulfilled in days, not weeks.
Distributed models can work if you build the right infrastructure. You need standardized logging that feeds into enterprise-wide dashboards. You need automated deadline alerts that escalate to department heads and the privacy office simultaneously. You need regular training that reaches every intake point. You need clear escalation paths when departments encounter technical barriers or legal questions.
Where practitioners actually land
Most healthcare organizations operate somewhere between these poles. They centralize complex requests while allowing departments to handle routine ones directly. A request for "all records from my March visit" stays local. A request for "everything you have on me for the past ten years, including billing disputes and insurance correspondence" gets routed to the privacy office.
The trigger for centralization varies. Some organizations centralize based on record volume, timeframe, or number of departments involved. Others centralize when the request comes through formal channels like certified mail or patient portal submissions, but allow informal requests at the point of care to be handled locally. Still others centralize only after a request goes unanswered for 15 days, using the central team as a safety net rather than a first responder.
The corrective action plan OCR imposed on Azul Vision points toward a hybrid reality. The requirement to "review and revise policies and procedures" and provide workforce training suggests that Azul Vision lacked consistent processes across its optometry and ophthalmology services. The monitoring requirement mandates centralized reporting even if intake remains distributed.
Our take
Centralize your logging and monitoring, even if you distribute initial responsibility. The Azul Vision settlement illustrates what happens when no single person can answer "where is this request right now?" two months after it arrives. A patient shouldn't need to file a federal complaint to learn that her January 2023 request is still pending.
Start with a central registry that captures every request regardless of where it enters your organization. Every clinic, every department, every patient portal must feed into this system within 24 hours of receipt. Assign each request a unique identifier and an owner. Set automated alerts at day 20, day 28, and day 30. Your privacy office reviews the dashboard daily and escalates anything approaching the deadline.
Let departments fulfill straightforward requests directly, but require them to log fulfillment in the central system with completion dates and delivery methods. This gives you the audit trail OCR will request when they investigate, and it gives you the data to identify which departments consistently miss deadlines.
For complex requests involving multiple departments, lengthy timeframes, or legal questions about redaction or fees, route them to your privacy office from the start. These are the requests most likely to trigger complaints, and they require expertise that doesn't exist uniformly across your organization.
Train every employee who might receive a records request to recognize one and log it immediately. The HIPAA Privacy Rule doesn't care whether your patient asked the receptionist, emailed the billing department, or submitted a formal portal request. The 30-day clock starts when any part of your organization receives it. Azul Vision's two-year delay suggests the initial request never made it into any tracking system at all.
Your corrective action plan shouldn't wait for a $50,000 settlement. Review your current process against these questions: Can you produce a complete list of every access request received in the past 90 days? Can you identify the status of each one? Can you prove when each was fulfilled or explain why it wasn't? If the answer to any of these is no, you're operating without the visibility that prevents OCR investigations from turning into enforcement actions.
