The settlement marks OCR’s 56th enforcement action focused on patients’ right to access their health records.
October 8, 2026: The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), announced a $140,000 settlement with Linda L. Shen, doing business as Shen Smiles, P.C., a Pennsylvania dental practice. The agreement resolves an investigation into potential HIPAA Privacy Rule violations following a complaint that the practice failed to provide a patient with timely access to her protected health information (PHI).
Patient Complaint Leads to Investigation
OCR began investigating after receiving a complaint that a patient had requested her health records multiple times but had not received timely access. During the investigation, Shen Smiles told OCR that it could not provide the requested information because a workforce member had stolen the records from the practice.
The investigation identified problems beyond the handling of the patient’s requests. According to OCR, Shen Smiles had not implemented policies and procedures needed to comply with the HIPAA Privacy and Breach Notification Rules. These gaps included the absence of policies and procedures for responding to requests for access to health records. OCR also determined that the practice had not reasonably safeguarded PHI against intentional or unintentional uses or disclosures that would violate the Privacy Rule.
Settlement Reached Before an Administrative Hearing
On July 31, 2024, OCR issued a Notice of Proposed Determination seeking to impose a civil money penalty. Shen Smiles subsequently requested a hearing before an administrative law judge.
Before that hearing took place, the parties reached a resolution agreement on August 11, 2026. Under the agreement, Shen Smiles agreed to pay $140,000 to OCR. HHS publicly announced the settlement on October 8, 2026.
Privacy Policies Must Also Support Patient Rights
In the announcement, OCR Director Paula M. Stannard emphasized that the Privacy Rule’s administrative requirements do more than protect health information from improper use or disclosure. They also help covered entities meet their responsibilities to patients, including honoring requests to access health records.
Understanding HIPAA’s Right of Access
The HIPAA Privacy Rule generally gives individuals, or their personal representatives, the right to access their health information. Covered entities must act on an access request no later than 30 calendar days after receiving it.
When a covered entity cannot meet that deadline, it may take one extension of up to 30 additional calendar days. To use the extension, it must notify the individual in writing within the original 30-day period, explain the reason for the delay, and provide the date by which it will complete its action on the request. The extension is not automatic.
Along with protecting the privacy of health information, the Privacy Rule gives individuals the right to review and obtain copies of their records, subject to certain exceptions. Any permitted fees for copies must be reasonable and cost-based.
The Notice of Proposed Determination may be found here.
The Resolution Agreement may be found here.