The U.S. Department of Health and Human Services (HHS) announced a $140,000 settlement with Pennsylvania dental practice Shen Smiles on October 8, 2026, after a patient’s records request prompted an investigation into its privacy practices.

 

What happened

HHS’ Office for Civil Rights (OCR) began investigating after receiving an April 2020 complaint that the practice had not fulfilled repeated requests for a former patient’s records. Shen Smiles said a workforce member had stolen the documents.

OCR’s detailed enforcement notice describes patient records stored in unsecured locations, including plastic boxes, the floor, and a private bathroom. Files were regularly missing when patients arrived for appointments. Investigators also found that employees had received no formal HIPAA Privacy Rule training and that the practice had not provided evidence of required privacy and breach-notification policies.

OCR proposed a $140,000 civil monetary penalty in July 2024, which the practice challenged. The parties resolved the matter on August 11, 2026. The resolution agreement states that Shen Smiles did not admit liability.

 

What was said

In its 2024 enforcement notice, OCR addressed the practice’s argument that the violations had not caused demonstrable harm. Investigators had not found evidence of physical, financial, or reputational harm, or that the failures had prevented someone from obtaining healthcare.

However, OCR stated that “this good fortune cannot be attributed to any actions by Shen Smiles” and treated the absence of documented harm as neither an aggravating nor a mitigating factor in determining the proposed penalty.

 

Why it matters

The HHS identifies the settlement as its 56th HIPAA right-of-access enforcement action. It follows a similar case covered by Paubox in September 2026, in which Azul Vision agreed to pay $50,000 after a patient waited nearly two years for her medical records. OCR fulfilled the request only after it began investigating.

Both cases show how one patient’s difficulty obtaining records can expose weaknesses in everyday administrative practice. At Shen Smiles, the investigation revealed unsecured storage and missing privacy procedures. Azul Vision’s corrective action plan required a review of access policies, annual staff training, and reports every 90 days documenting requests and their completion dates. Those requirements offer a practical model for accountability, as each request needs an identifiable owner, a traceable response, and follow-through when access remains outstanding.

HHS guidance generally recognizes a patient’s right to receive copies by email when requested. HIPAA compliant email can help a practice meet that preference while protecting information in transit. Its practical value comes from being part of a reliable release process, with records available for retrieval and staff accountable for completing the request.

See also: HIPAA Compliant Email: The Definitive Guide (2026 Update)

 

FAQs

How quickly must a practice respond to a records request?

HIPAA generally requires action within 30 calendar days, with one extension of up to 30 days if the practice provides written reasons and a completion date before the original deadline.

 

Does HIPAA protect paper dental records?

Yes, the Privacy Rule protects identifiable health information held by covered entities in paper, electronic, and oral forms.

 

Can a patient request records by unencrypted email?

Yes, HHS guidance allows this when the patient is warned about transmission risks and confirms the preference, while the provider still applies reasonable safeguards in fulfilling the request.