HHS OCR settlement announced October 8, 2026
One Patient Complaint, a $140,000 HIPAA Penalty: The Shen Smiles Settlement
HHS's Office for Civil Rights announced a $140,000 settlement with Shen Smiles, a small Pennsylvania dental practice, after a single former patient's complaint about access to her records opened a wider investigation. OCR did not pursue the access complaint itself, because the practice stated the records had been taken by a former employee, but investigators found the practice had no HIPAA policies and procedures at all, kept records in unsecured locations, moved them between offices and the dentist's home, and had not trained its workforce. OCR calculated two violations running about six years at up to $700,000 each and reduced the total by 90 percent for the practice's small size. It is also, by one compliance tracker's count, the 56th settlement in OCR's Right of Access initiative.
Executives
A ten-person practice paid $140,000 not because of a hacker, but because it could not produce basic policies when a regulator asked. The lesson scales: compliance programs fail on paper long before they fail in practice, and small size reduced the fine without excusing the violations.
CIO / CISO
Be able to produce, on request: written privacy, security, and breach-response policies that match actual operations; named Privacy and Security Officials; documented workforce training; a current security risk analysis; and business associate agreements for every vendor touching PHI. An EHR vendor does not carry these duties for you.
Engineers
Support the program with evidence your tooling already generates: access logs, terminated-user deprovisioning records, encryption status, and backup reports. When an employee departs, credential removal and record custody are security events, not just HR paperwork.
Everyone (non-IT)
You have a legal right to get a copy of your own health records, and asking for them is never out of line. If a provider stalls repeatedly, the HHS Office for Civil Rights accepts complaints, and as this case shows, one complaint can trigger a full review.