HHS Civil Rights Office Resolves HIPAA Privacy Rule Probe Involving Dr. Linda L. Shen and Shen Smiles, P.C.

By
Office for Civil Rights (OCR)
October 8, 2026

United States Department Of Health And Human Services

At a Glance

Category	Detail
Condition	OCR investigated a complaint alleging delayed access to protected health information (PHI) and found failures to establish required policies and procedures and to reasonably safeguard PHI.
Key Mechanisms	OCR found that Shen Smiles had not established policies and procedures concerning PHI intended to ensure compliance with the Privacy and Breach Notification Rules, including policies addressing the right of access. OCR also found that it had not reasonably safeguarded PHI against uses or disclosures that would contravene the Privacy Rule.
Target Population	Individuals and their personal representatives seeking access to health information; the enforcement matter involved a Pennsylvania healthcare provider offering dental services.
Care Setting	Pennsylvania healthcare provider offering dental services; OCR and Shen Smiles resolved the enforcement action through an August 11, 2026 resolution agreement.

Key Highlights

On October 8, 2026, OCR announced a resolution agreement with Linda L. Shen, doing business as Shen Smiles, P.C.
The investigation followed a complaint alleging that an individual did not receive timely access to PHI despite multiple requests.
Shen Smiles maintained that it could not provide access because a workforce member had stolen the records.
OCR found failures to establish policies and procedures concerning PHI, including the right of access, and to reasonably safeguard PHI.
Under the August 11, 2026 resolution agreement, Shen Smiles consented to pay OCR $140,000.

Guideline-Based Recommendations

Diagnosis

The article describes an OCR investigation into a complaint alleging delayed access to PHI and findings concerning policies and safeguards; it does not provide clinical diagnostic guidance.

Management

The article states that the HIPAA Privacy Rule requires individuals and their personal representatives to receive timely access to health information within 30 days, subject to a possible single 30-day extension.
The article states that the Privacy Rule establishes standards for safeguarding health records, limits and conditions on PHI uses and disclosures, and individual rights including access to health records.

Monitoring & Follow-up

The article does not discuss clinical monitoring. It states that OCR enforces the HIPAA Rules and provides guidance concerning the Privacy, Security, and Breach Notification Rules.

Risks

OCR found that Shen Smiles had not reasonably safeguarded PHI against intentional or unintentional uses or disclosures that would contravene the Privacy Rule.
The article reports that OCR resolved the enforcement action through an agreement under which Shen Smiles consented to pay $140,000.

Patient & Prescribing Data

Individuals and their personal representatives seeking access to health information; the complaint involved a patient of a Pennsylvania healthcare provider offering dental services.

No prescribing or treatment information is reported. The article concerns PHI access, safeguards, and an OCR enforcement settlement.

Clinical Best Practices

The article describes the Privacy Rule requirement for timely access to health information within 30 days, subject to a possible single 30-day extension.
The article describes the Privacy Rule’s requirements concerning safeguards for PHI and policies and procedures addressing individual rights.
OCR accepts complaints concerning alleged violations involving health information privacy, civil rights, or conscience rights.