October 9, 2026
The latest HIPAA penalty doesn’t involve a hospital system or a massive ransomware attack. It involves a practice that probably looks a lot like yours.
Dr. Linda Shen is the owner of Shen Smiles, a solo dental practice with one location in Drums, Pennsylvania. It all started with one patient asking for their health records. It ended with a $140,000 penalty and a much closer look at how the practice handled HIPAA.
The lesson? Every HIPAA-regulated practice, big or small, can face enforcement.
What happened?
It’s unclear when the patient first asked for their records, but patient records need to be provided within 30 days from the initial request. In April 2020, the patient’s attorney filed a complaint with the Office for Civil Rights (OCR). The patient had asked for their health records multiple times and never got it.
Once OCR started digging, the missed request turned out to be just the beginning. Patient records weren’t properly maintained, staff had never received formal HIPAA Privacy Rule training, and there were no policies for handling patient requests.
Dr. Shen admitted that the records were never provided because a former employee had taken them. That’s another violation, this theft is a breach, which means it needed to be reported to the OCR, patients needed to be notified, and given options to protect themselves (such as credit monitoring).
These are baseline requirements every Covered Entity is expected to have in place. No compliance framework, like policies and training, means no HIPAA playbook, so when a patient asks for records (or records go missing), staff is unprepared and unaware how to handle the situation.
In July 2024, OCR proposed a $140,000 Civil Money Penalty. Dr. Shen appealed, but ultimately settled on the full amount.
The Takeaway for Practices
Patient access has been an OCR priority for years through its HIPAA Right of Access Initiative. And as this case shows, one complaint is all it takes to open the door to a review of your entire compliance program.
Now is the time to ask: Do we have written HIPAA policies our team can find? Do we have a process to answer every record request within 30 days? Can we prove every team member has completed HIPAA training? If any of those gave you pause, now’s the time to fix it, before OCR comes asking.
Looking for the first step? Meet with one of our compliance experts to see where you currently stand.
