The Challenge
On April 21, 2020, the Office for Civil Rights (OCR) received a complaint from a patient's attorney, sparking an investigation into Shen Smiles, a Pennsylvania dental practice. The initial issue was clear: multiple requests for a patient's medical records had gone unanswered. However, the investigation revealed more serious problems than just a delayed records request.
Patient records were not organized. Files were kept in clear plastic boxes in the hygienist's office, on floors, and even in a private bathroom. Staff frequently moved records between office locations and Dr. Linda L. Shen's home. Often, patient records couldn't be found when needed.
Dr. Shen claimed a former office manager had stolen documentation, including policies and procedures for handling protected health information. No action was taken against the employee, and no preventive measures were implemented. When OCR requested evidence of HIPAA Privacy Rule compliance under 45 C.F.R. §§ 164.530(c), 164.502(a), and 164.404-408, Dr. Shen's response was "None."
The practice had never provided formal HIPAA training to its workforce.
The Environment and Constraints
Shen Smiles operates as a small, rural dental practice. This is significant because OCR considers the size of a covered entity when determining penalties, ensuring that fines don't threaten a provider's ability to operate. Many small healthcare providers mistakenly believe that HIPAA enforcement targets only large hospital systems.
However, the regulatory environment doesn't make such distinctions. Under 45 C.F.R. § 164.530(i)(1), every covered entity must have policies and procedures to comply with the HIPAA Privacy Rule. Additionally, 45 C.F.R. § 164.530(c)(2)(i) requires administrative safeguards to protect the privacy of protected health information.
OCR's Right of Access enforcement initiative, active since 2019, targets providers who fail to respond to patient records requests within the 30-day timeframe required by 45 C.F.R. § 164.524. By October 9, 2026, this case became the 56th enforcement action under that initiative resulting in a financial penalty.
Shen Smiles lacked documented policies, workforce training, and physical security controls to meet even basic administrative safeguard requirements. When OCR requested documentation, the practice's attorney initially objected, escalating the matter to HHS's Regional Office of General Counsel, which issued a formal compliance demand.
The Approach Taken
Dr. Shen initially resisted. The practice objected to OCR's data request through legal counsel. When the Regional Office of General Counsel intervened, Dr. Shen claimed the requested documents didn't exist because they'd been stolen.
OCR expanded its investigation to examine administrative safeguards and breach notification procedures. Dr. Shen consistently indicated that no documentation existed.
When OCR offered to settle the alleged violations informally, Shen Smiles declined, opting to submit evidence for a penalty waiver. OCR reviewed the submission and found it insufficient.
The practice then requested a hearing before an administrative law judge. Before the hearing, Shen Smiles agreed to a resolution agreement. Throughout, no corrective actions were taken proactively, and the focus remained on legal objections and waiver requests rather than remediation.
Results and Metrics
OCR found that Shen Smiles violated 45 C.F.R. § 164.530(i)(1) regarding policies and procedures and 45 C.F.R. § 164.530(c)(2)(i) regarding administrative safeguards. The violations were due to reasonable cause, not willful neglect, affecting penalty tiers under HIPAA.
The maximum penalty for these violations was $1,400,000. OCR applied a 90% reduction based on the practice's size and location, determining that the maximum fine would jeopardize Shen Smiles' operations.
The final resolution required a $140,000 penalty. This case was OCR's 11th HIPAA case in 2026 resolved with a financial penalty and the second under the Right of Access initiative. By October 9, 2026, OCR had collected $3,170,250 in penalties from 2026 enforcement activities.
What They Would Do Differently
The resolution agreement doesn't detail Shen Smiles' corrective action plan, but the investigation highlights what should have been in place.
First, implement documented policies and procedures for handling Data Subject Access Requests under 45 C.F.R. § 164.524. This is a core requirement of 45 C.F.R. § 164.530(i)(1). Your policies must specify how requests are received, tracked, fulfilled, and documented.
Second, establish physical safeguards for protected health information. Records can't be unsecured or casually transported. Under 45 C.F.R. § 164.530(c)(2)(i), you're required to implement administrative safeguards that protect PHI privacy, including restricting access to authorized personnel and maintaining records in secure environments.
Third, provide formal HIPAA Privacy Rule training to your entire workforce. Under 45 C.F.R. § 164.530(b), you must train all workforce members on your privacy policies and procedures. Document that training and retain those records.
Fourth, implement breach notification procedures that comply with 45 C.F.R. §§ 164.404-408. Unauthorized removal of PHI is a security incident requiring investigation and possibly breach notification.
Fifth, respond cooperatively to OCR investigations. Objecting to data requests doesn't demonstrate good faith. It signals unpreparedness for oversight.
Takeaways for Your Team
If you're managing risk for a small healthcare provider, this case shows that OCR enforces compliance across all provider sizes. The Right of Access initiative has resulted in 56 financial penalties, targeting providers who fail basic compliance requirements.
Your administrative safeguards program must include documented policies, workforce training records, and physical security controls. These are regulatory requirements under 45 C.F.R. § 164.530.
When you receive a patient request for records, you have 30 days to respond under 45 C.F.R. § 164.524. Track these requests, document your response, and ensure records are locatable.
OCR's penalty calculations consider entity size. Shen Smiles received a 90% reduction from the maximum penalty, but a $140,000 penalty still impacts a small practice. The reduction mitigates risk but doesn't eliminate it.
If OCR investigates, cooperate fully and document remediation efforts immediately. Objecting to data requests or seeking penalty waivers without corrective action doesn't yield favorable outcomes. OCR wants evidence of compliance improvements.
Build your HIPAA program around documentation. Policies in someone's head don't satisfy 45 C.F.R. § 164.530(i)(1). Informal training doesn't meet 45 C.F.R. § 164.530(b). Security relying on memory doesn't fulfill 45 C.F.R. § 164.530(c)(2)(i).
The threshold for HIPAA compliance isn't perfection. It's documented, reasonable, and appropriate safeguards. Shen Smiles couldn't demonstrate these elements. Don't let that be your story.
