Start with a records request. Add a seven months’ wait. Stir in the chaos of the pandemic, with most employees working from home. Blend in a perhaps-neglected post office box. Bake for two-and-a-half years.

The result of this recipe? A settlement between the HHS Office for Civil Rights (OCR) and the nation’s largest health insurance firm, which includes an $80,000 penalty and a one-year corrective action plan (CAP). OCR’s agreement with UnitedHealthcare (UHC) marks the 45th enforcement action in its right of access initiative, which then-Director Roger Severino launched in 2019. OCR made the settlement public Aug. 24, about three weeks after it was signed.^[1]

One of the CAP requirements is for UHC to submit an accounting to OCR every 90 days of how it fulfilled all requests for records received at what it called the insurer’s “regional mail operations post office box” in Salt Lake City, Utah.^[2]

In announcing the settlement, OCR Director Melanie Fontes Rainer noted that “health insurers are not exempt from the right of access and must ensure that they are taking steps to train their workforce to ensure that they are doing all they can to help members’ access to health information.” Although the agency called this the 45th settlement, it is not. Several cases were concluded with OCR imposing penalties in court against uncooperative covered entities (CEs).

OCR provided salient—but scant—details about what led to the agreement and left some blanks. It received a complaint on March 25, 2021, alleging UHC had not responded to a records request that OCR said was first submitted on Jan. 7, 2021. The request was “received via mail at a post office box located in Utah,” the agency said.