Clinical Report: OCR Settles HIPAA Right-of-Access Probe Involving Shen Smiles

Overview

HHS’s Office for Civil Rights (OCR) resolved a HIPAA Privacy Rule enforcement action involving Dr. Linda L. Shen, doing business as Shen Smiles, P.C., after a complaint alleged delayed access to an individual’s protected health information (PHI). Under an August 11, 2026 resolution agreement, Shen Smiles consented to pay $140,000; OCR identified deficiencies in policies and procedures for the Privacy and Breach Notification Rules and in safeguards for PHI.

Background

The HIPAA Privacy Rule gives individuals and their personal representatives a right to timely access to health information, generally within 30 days, with a possible single 30-day extension. The Rule also establishes standards for protecting PHI and limits its use and disclosure. OCR investigates complaints and enforces these requirements, including through its Right of Access initiative. The Shen Smiles settlement was described by OCR as its 56th enforcement action under that initiative.

Data Highlights

Key Findings

• OCR opened its investigation after receiving a complaint alleging delayed access to an individual’s PHI despite multiple requests.
• Shen Smiles told OCR it could not provide access because a workforce member had stolen the records.
• OCR determined that Shen Smiles had not established policies and procedures concerning PHI to support compliance with the Privacy and Breach Notification Rules, including procedures addressing the right of access.
• OCR also found that Shen Smiles had not reasonably safeguarded PHI against intentional or unintentional uses or disclosures contrary to the Privacy Rule.
• After OCR issued a proposed civil money penalty and Shen Smiles requested an administrative law judge hearing, the parties settled before the hearing; Shen Smiles consented to a $140,000 payment.
• In a related enforcement action, OCR announced an August 2026 settlement with California provider Azul Vision, Inc. concerning a potential HIPAA Privacy Rule violation involving access to records.

Clinical Implications

Covered entities should maintain policies and procedures addressing individual access requests and safeguards for PHI, consistent with the HIPAA Privacy Rule. The general access timeframe is 30 days, with a possible single 30-day extension; OCR’s announcement identifies access and administrative safeguards as central issues in this enforcement action.

Conclusion

The Shen Smiles resolution addresses alleged delayed access alongside OCR findings concerning required policies and PHI safeguards. It is OCR’s 56th enforcement action under its HIPAA Right of Access initiative.

Related Resources & Content

1. U.S. Department of Health and Human Services, Office for Civil Rights, 2026 — HHS’ Office for Civil Rights Settles HIPAA Privacy Rule Investigation with Dr. Linda L. Shen d/b/a Shen Smiles, P.C.
2. U.S. Department of Health and Human Services, 2026 — HHS Office for Civil Rights Reaches Settlement with Azul Vision, Inc. Over HIPAA Access Investigation
3. ADA News, 2022 — Three dental providers settle cases for potential HIPAA violations regarding records
4. ADA News, 2022 — Three dental practices subject to enforcement actions for potential HIPAA violations
5. United States Department of Health and Human Services — HHS’ Office for Civil Rights Settles Ransomware Investigation with Health Plan
6. HHS’ Office for Civil Rights Settles HIPAA Privacy Rule Investigation with Dr. Linda L. Shen d/b/a Shen Smiles, P.C.
7. HHS Office for Civil Rights Reaches Settlement with Azul Vision, Inc. Over HIPAA Access Investigation
8. Under the HIPAA Privacy Rule, do individuals have the right to an electronic copy of their PHI?
9. Impact of online patient access to clinical notes on quality of care: a systematic review