A Pennsylvania dental practice, Shen Smiles, agreed to pay $140,000 to the HHS Office for Civil Rights (OCR) to resolve HIPAA Privacy Rule violations, HHS announced on October 8, 2026. OCR had calculated a maximum penalty of $1.4 million, then cut it by 90% because the practice is small and rural.

The violations had nothing to do with hackers or technology. OCR asked the practice for its written privacy policies and its breach procedures, and the practice had none of them. It had also never formally trained staff.

It started with one records request

In April 2020, a patient's attorney complained to OCR that the practice had not provided the patient's records after multiple requests, according to the HIPAA Journal. Under HIPAA's right of access, you have 30 days to give patients their records, with one 30-day extension allowed.

The practice told OCR it could not provide the records because a former office manager had taken them. That answer opened a second set of questions about how patient records were kept and protected.

What OCR asked for, and what the practice had

OCR requested the practice's policies on patient records requests. When the theft came up, it also asked for the practice's privacy safeguards, its breach notification procedures, and copies of any breach notices sent after the theft. The practice answered "None" to the additional requests, the HIPAA Journal reported.

The investigation also found:

  • Paper patient files kept in clear plastic boxes, on the floor, and in boxes in a private bathroom
  • Files carried between office locations and the dentist's home
  • Patient records that often could not be found when patients arrived for appointments
  • No formal HIPAA Privacy Rule training for staff
  • No discipline for the employee believed to have taken the records, and no steps to prevent it from happening again

HHS summarized it this way: the practice "failed to implement policies and procedures" designed to comply with the Privacy and Breach Notification Rules, including right of access procedures, and "did not reasonably safeguard PHI."

"The Privacy Rule's administrative requirements are essential to protect not only PHI from impermissible use or disclosure, but also to ensure that covered entities are able to meet their obligations related to individual rights, such as the right of access," said OCR Director Paula M. Stannard.

How OCR got from $1.4 million to $140,000

OCR penalized two problems: no written policies, and no safeguards for patient information. It found the practice should have known better but was not deliberately ignoring the rules, and set the maximum at $700,000 for each problem, or $1.4 million in total.

HIPAA tells OCR to consider whether a penalty would put a practice's ability to keep providing care at risk. OCR decided the full amount could, and cut it by 90% because Shen Smiles is a small practice.

Note the order of operations: the size discount is already built into how OCR calculates a penalty, and the number after the discount was still $140,000.

One complaint, six years

A single complaint filed in April 2020 was still costing the practice in 2026. Along the way, OCR offered to settle informally, the practice declined, and the case moved toward a hearing before the two sides settled in August 2026.

What to have on paper

None of what OCR asked for requires new software. These are the questions to answer for your own practice:

  • Do you have a written procedure for patient records requests, including who handles them and the 30-day deadline?
  • Would your front desk recognize a written records request, even one that arrives from an attorney or by email?
  • Do you keep a log of each request, when it came in, and when you responded?
  • Do you have written privacy policies and a written breach procedure you could hand over this week?
  • Can you show when each staff member completed HIPAA training, and on what?
  • Are paper charts stored somewhere locked, and do they stay at the office?

Feeling covered and being able to hand over proof are two separate things. In a Paubox survey of healthcare organizations with fewer than 250 employees, more than 80% expressed confidence in their compliance (Paubox, 2025). In this case, OCR asked for paper.

If a patient's attorney wrote to you tomorrow, which documents could you send by Friday?

Our HIPAA compliant email checklist walks through the same documentation steps for the records and messages you send by email.

How fast do I have to respond to a patient's records request?

Within 30 days, with one 30-day extension if you tell the patient in writing why you need it. Patients can ask for records by email, and HIPAA permits sending them that way. Read how Paubox helps with HIPAA right of access.

Does HIPAA require staff training?

Yes. The Privacy Rule requires you to train your workforce on your own policies and procedures, and to document it. Our guide to HIPAA privacy and security training covers what to include and what records to keep.

Does OCR fine small practices less?

OCR considers a practice's financial condition and can reduce a penalty, as it did here by 90%. A reduced penalty can still reach six figures.

Does sending records by email create more HIPAA risk?

Not when the email is protected. HIPAA lets you send patients their records by email when they ask for it, and HIPAA compliant email keeps those records secure on the way.