Dental HIPAA Violations: Real OCR Cases

From HHS's public list of resolution agreements and civil money penalties. Last reviewed November 2026.

OCR's dental cases rarely involve sophisticated hacking. They usually start with one patient who couldn't get their records, or one reply to an online review, and then turn on whether the practice had the required policies and records.

2026: a solo Pennsylvania practice, $140,000

HHS lists a resolution agreement with Dr. Linda L. Shen d/b/a Shen Smiles, P.C., a Pennsylvania dental practice, dated August 10, 2026, as a HIPAA Privacy Rule investigation. According to published reports of the settlement, announced in October 2026:

• the practice paid $140,000;
• it began with a complaint from a patient who said she had made multiple requests for her records;
• OCR said it found the practice had no Privacy Rule or Breach Notification policies and procedures, including no right-of-access policy, and had not reasonably safeguarded patient information;
• OCR had proposed a civil money penalty, and the matter settled before a hearing;
• OCR counted it as its 56th Right of Access enforcement action.

The lesson for a small office: the money followed missing paperwork. A written access procedure, a request log and a basic policy manual are exactly what was absent.

Other dental cases on HHS's list

• October 2024: Gums Dental Care, $70,000 civil money penalty for failure to provide timely access to patient records.
• December 2022: a settlement with a dental practice over disclosures of patients' protected health information.
• September 2022: settlements with three dental practices over patients' right of access.
• October 2019: a dental practice paid $10,000 to settle disclosures of patients' information on social media, in replies to patients' online reviews.

You can read the announcements on HHS's resolution agreements page.

What the cases have in common

1. Records requests. Most dental actions are right-of-access cases. The rule allows 30 days, plus one 30-day extension with written notice (45 CFR 164.524(b)(2)). Holding records until a bill is paid, charging search fees, or ignoring an emailed request are the usual triggers. How to handle requests.
2. No written policies. Once OCR opens a case, it asks for your policies, training records and risk analysis. Not having them turns a single complaint into findings across the whole program.
3. Online reviews. A reply that confirms someone is a patient, or mentions their treatment, is a disclosure. Reply generically, or not at all.
4. Risk analysis. In security cases, a missing or outdated risk analysis is the deficiency OCR cites most often.

What a resolution agreement involves

Besides the payment, a resolution agreement usually includes a corrective action plan: the practice agrees to adopt policies, train staff and report to HHS, generally for a period of three years, while HHS monitors compliance. Civil money penalty amounts are set by tier and adjusted for inflation every year (45 CFR 102.3).

How to avoid being the next case

1. Put a written records-request procedure and log at the front desk this week. Our free kit has both.
2. Adopt written privacy, security and breach policies, and train everyone on them.
3. Do (and document) your risk analysis, and keep evidence of what you fixed.
4. Keep it all for six years in one place. The full checklist.