Dr. Linda L. Shen d/b/a Shen Smiles, P.C., a dental practice in Pennsylvania, decided to pay $140,000 to the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) to resolve its alleged HIPAA Privacy Rule violations concerning patient access to health records and the security of protected health information (PHI).
Settlement Details
On October 8, 2026, HHS announced a settlement agreement made on August 11, 2026 that Shen Smiles will pay $140,000 to OCR. This settlement concerns an enforcement action over Shen Smiles’ alleged failures to provide prompt PHI access to patients and inadequate policies and procedures to safeguard patient data.
The settlement is the 56th enforcement action issued by OCR in relation to its HIPAA Right of Access enforcement initiative.
Complaint and Investigation
OCR received a complaint on April 21, 2020 that Shen Smiles failed to give copies of health records to a patient even after multiple requests. OCR informed the practice concerning the complaint on May 20, 2020, stating that there will be an investigation.
OCR asked for the practice’s policies and procedures for handling requests for patient PHI. However, Shen Smiles gave OCR an affidavit saying there is no such documentation because an employee stole them.
OCR then asked Shen Smiles for documentation of its breach notification policies and procedures, and records of any breach notifications sent to affected individuals. Shen Smiles responded that no such documentation was available.
According to HHS’ report, Shen Smiles stated during the investigation that it could not comply with the patient’s request because an employee had stolen the records.
Investigative Findings
OCR confirmed that Shen Smiles did not follow policies and procedures for handling PHI in compliance with the HIPAA Privacy Rule and HIPAA Breach Notification Rule. The investigation findings included the lack of policies and procedures regulating individuals’ right of access to their medical data.
The investigation likewise discovered inadequacies in safety measures for physical patient documents. Patient files were kept in unsecured places, such as clear plastic boxes in a hygienist’s office, on the ground, and in boxes in a private restroom. Documents were also moved between office sites and Dr. Shen’s residence.
The practice’s documents were not constantly accessible when patients came for consultations. Dr. Shen explained that she thought an ex-office manager had illegally obtained patient information. The practice hadn’t disciplined the staff or done anything to avoid identical incidents. Dr. Shen also stated that employees had not gotten formal training on the HIPAA Privacy Law.
Proposed Penalty and Resolution
On July 31, 2024, OCR released a Notice of Proposed Determination issuing a civil monetary fine. Shen Smiles asked for a hearing before an administrative law judge.
OCR decided that the violations were within the acceptable cause category instead of willful neglect. The maximum penalty imposed is $1,400,000, that is $700,000 for each of two violations. OCR then used a 90% decrease according to the size of the covered entity, identifying that the maximum penalty could endanger the practice’s capability to operate.
The HIPAA Privacy Rule requires regulated entities to give individuals or their personal representatives with prompt access to health data within 30 days. One 30-day extension is allowed.
OCR’s investigative results in the Shen Smiles issue included missing right of access policies and procedures and the inability to reasonably secure PHI against uses or disclosures that would break the HIPAA Privacy Rule.