On Dec. 16, 2025, the Department of Health and Human Services, Office for Civil Rights (HHS-OCR) announced a $112,500 settlement with Concentra after alleging the Texas-based physical and occupational health provider failed to provide an individual with access to his protected health information (PHI) within 30 days of his request, as required by the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. 

HHS-OCR alleged that the individual made a total of six requests for his health information and did not receive access to his information until more than a year after his initial request. This settlement marks the 54^th enforcement action taken by HHS-OCR in its Right of Access Enforcement Initiative, demonstrating that the right of individuals to access PHI continues to be an enforcement priority.