You are a manager working for an orthopedic surgery group in California, and you are responsible for administering patient access to health records. You get word that one of the company’s employees responded to a written patient request for their health records by telling them that they had to make their account current prior to receiving the records. You see documentation that the request was made a little less than a month ago. 

What would you research prior to taking action?