$140,000 HIPAA Penalty: Shen Smiles and Right of Access Rules

Small medical and dental practices face mounting federal penalties for failing to comply with federal patient record timelines, as federal regulators demonstrate that practice size provides no exemption from HIPAA Right of Access enforcement.

Federal Enforcement Targets Small Practices

• Federal regulators require healthcare providers to fulfill patient record requests within 30 calendar days, regardless of practice size or administrative staffing levels.
• Recent enforcement actions by the US Department of Health and Human Services Office for Civil Rights resulted in financial settlements against smaller practitioners and regional providers.
• Practices must count calendar days rather than business days, and outstanding patient bills do not legally permit providers to withhold medical records.

Federal Scrutiny Expands Beyond Large Hospital Networks

Federal oversight of patient medical record access has intensified significantly since the US Department of Health and Human Services Office for Civil Rights launched its Right of Access Initiative in 2019. Prior to 2019, HIPAA enforcement actions tended to focus on large data breaches or other issues affecting hospitals. The regulatory focus has since shifted toward small practices, targeting independent practitioners and regional medical groups that fail to provide patients with timely access to their protected health information.

Shen Smiles, a small rural dental practice in Pennsylvania, has agreed to pay a $140,000 financial penalty to resolve years-long violations of the HIPAA Privacy Rule that were identified during an investigation of a HIPAA Right of Access complaint.https://t.co/eLv3mWfaQb

— https://x.com/HIPAAJournal/status/2108573206021915122

Two enforcement actions settled in late 2026 underscore the financial risks facing smaller healthcare operations. In August 2026, the Office for Civil Rights resolved an investigation into Azul Vision, Inc., a California-based optometry and ophthalmology provider, following a patient complaint that originated in January 2023. The patient requested her records, received no response, and subsequently filed a formal complaint in April 2023. Federal regulators found that the provider failed to deliver the records until January 2025, two years after the patient filed her request.

Under the resulting settlement agreement, Azul Vision agreed to pay a $50,000 fine and entered into a 2-year corrective action plan monitored by the OCR. The provider must revise its Right of Access policies and procedures, train all workforce members, and submit regular logs of every protected health information request and its completion date to the Department of Health and Human Services.

Record-Keeping Failures Trigger Penalties at Shen Smiles

An enforcement action concluded in October 2026 against Linda L. Shen, DDS, at Shen Smiles PC. The investigation began in April 2020 after a former patient filed a complaint stating that repeated requests for medical records went unanswered. Federal investigators discovered that the practice had not maintained patient records properly, with physical files transported between the office and the private homes of the doctor and her office manager.

Investigators located patient records in vulnerable locations, including clear plastic boxes on the floor and inside a bathroom. The complainant’s records were missing entirely, an occurrence the practitioner attributed to a former employee. The federal investigation concluded that the practice had implemented no policies or safeguards regarding protected health information, resulting in an initial penalty exceeding $1 million. The Office for Civil Rights lowered the penalty to $140,000 under a settlement agreement that requires a 2-year supervision plan.

Provider Entity	Initial Request Date	Resolution Date	Financial Penalty	Corrective Action Mandate
Azul Vision, Inc	January 2023	August 2026	$50,000	2-year monitoring plan
Shen Smiles PC	April 2020	October 2026	$140,000	2-year supervision plan

Compliance Mandates Under Federal Right of Access Rules

Under HIPAA guidelines, covered entities—including most practices that accept Medicare—must act on patient requests within 30 calendar days from the date received. Acting on a request requires providing the records or issuing an official written denial backed by a valid legal reason. Federal rules specify calendar days rather than business days, meaning weekends and holidays do not extend the deadline. The statutory clock begins the moment a request enters the practice.

Outstanding patient bills do not legally permit providers to withhold or delay access to protected health information. Furthermore, practices cannot establish unreasonable administrative barriers, such as demanding that patients submit requests via certified mail or notarized forms. State regulations can also impose tighter restrictions; for example, California law requires compliance within 15 days, overriding the federal 30-day window.

Regulatory agencies continue to scrutinize practices of all sizes for record-handling compliance. The recent settlements demonstrate that lax internal organization and delayed fulfillment schedules expose individual practitioners and regional groups to financial liabilities.

Disclaimer: The information provided in this article is for educational and informational purposes only and does not constitute financial advice.