HIPAA Right of Access Investigation of Shen Smiles Resolved with $140K Penalty
The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has announced its 11th financial penalty of 2026 to resolve alleged violations of the Health Insurance Portability and Accountability Act (HIPAA). Linda L. Shen, doing business as Shen Smiles, a dental practice with locations in Drums and Tamaqua, Pennsylvania, has agreed to pay a financial penalty of $140,000 to resolve alleged violations of the HIPAA Privacy Rule.
OCR launched an enforcement initiative in late 2019 targeting noncompliance with the Right of Access of the HIPAA Privacy Rule, due to the volume of complaints OCR was receiving from patients who had not been provided with timely access to their health records. Since launching this initiative, OCR has resolved 56 HIPAA Right of Access investigations with financial penalties.
The HIPAA Right of Access gives individuals the right to inspect and obtain a copy of the protected health information (PHI) maintained by a HIPAA covered entity in a designated record set. An individual may only be charged a reasonable cost-based fee for a copy of their requested records. The records must be provided within 30 days of the request being received, although a 30-day extension is possible.
OCR launched an investigation of Shen Smiles after receiving a complaint on April 21, 2020, from the attorney of a former Shen Smiles patient who alleged that multiple requests had been made for the patient’s records; however, the records had not been provided. A month later, on May 20, 2020, OCR notified Shen Smiles about the complaint and OCR’s intention to initiate an investigation.
OCR requested copies of HIPAA policies and procedures; however, evidence was not provided to prove that Shen Smiles had implemented reasonable safeguards against unintentional uses and disclosures of PHI, and evidence was not provided to prove that policies and procedures existed to comply with the HIPAA Privacy Rule and Breach Notification Rule. Further, employees had not been provided with any formal HIPAA training.
OCR notified Shen Smiles about the intention to impose a financial penalty, and a hearing was requested with an administrative law judge; however, prior to the hearing, a settlement was negotiated. While the investigation sought to investigate an alleged violation of the HIPAA right of Access, the $140,000 penalty resolves alleged violations of 45 C.F.R. § 164.530(i) and 45 C.F.R. § 164.530(c)(2)(i).
“The Privacy Rule’s administrative requirements are essential to protect not only PHI from impermissible use or disclosure, but also to ensure that covered entities are able to meet their obligations related to individual rights, such as the right of access,” said OCR Director Paula M. Stannard.
