The article describes an OCR investigation into alleged delayed access to a patient’s protected health information and the resulting settlement with Pennsylvania dental provider Shen Smiles, P.C.
Approach:
Complaint and investigation: OCR investigated a complaint alleging that Shen Smiles did not provide timely access to an individual’s protected health information despite multiple requests.
Enforcement resolution: After OCR proposed a civil money penalty and Shen Smiles requested an administrative hearing, the parties settled before the hearing.
Key Findings:
Shen Smiles maintained that it could not provide access because a workforce member had stolen the records.
OCR found that Shen Smiles had failed to establish required policies and procedures, including procedures addressing individuals’ right of access.
OCR also found that Shen Smiles had not reasonably safeguarded PHI against impermissible uses or disclosures.
Under an August 11, 2026 resolution agreement, Shen Smiles consented to pay OCR $140,000.
Interpretation:
OCR described the action as its 56th enforcement action under HIPAA’s Right of Access. The Privacy Rule generally requires access within 30 days, with a possible single 30-day extension.
Limitations:
The matter was resolved by agreement before the requested administrative hearing occurred.
Conclusion:
OCR stated that enforcement of HIPAA rules protecting the privacy and security of health information remains a commitment.