A $1.4M Penalty Became $140K: What a Dental Practice’s HIPAA Settlement Really Signals to Small Providers

A $1.4 million proposed penalty became a $140,000 settlement for Shen Smiles, a small Pennsylvania dental practice. The 90% reduction may look like reassurance for small providers. It is not.

The U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) still pursued the practice, and the underlying failures were not sophisticated cyberattacks. OCR cited missing required policies and procedures and inadequate administrative safeguards.

The October 8, 2026 settlement announcement is a reminder that HIPAA obligations apply to small practices, too. Size affected the proposed penalty amount. It did not erase the compliance failures.

WHAT OCR’S SETTLEMENT SAYS

OCR’s investigation followed a patient-access complaint involving medical records the patient had requested. The practice reportedly attributed the lack of access to a workforce member’s theft of the records. OCR found that Shen Smiles had not implemented the required policies and procedures for patient access and had not maintained appropriate administrative safeguards.

OCR calculated a proposed civil money penalty of $1.4 million across two violation categories. It then applied a 90% reduction based on the provider’s small size, resulting in a $140,000 settlement. OCR identified it as the 56th enforcement action under its Right of Access initiative.

That distinction matters: a size-based reduction is not an exemption. The practice still faced an enforcement action, and the settlement remained significant for a small provider.

The case also points to a basic operational risk. When a staff member leaves, records go missing, or a patient request arrives during a busy week, the practice needs a process that still works. A policy that exists on paper but is not followed is not an effective safeguard.

PRIVACY RULE AND SECURITY RULE: BOTH MATTER

Small practices can mistake a patient-access request for a technology issue, or assume their security program covers every privacy obligation. HIPAA’s Privacy and Security Rules address different responsibilities.

The Privacy Rule governs how protected health information (PHI) may be used and disclosed, and gives individuals rights to access their records. In most cases, a practice must act on an access request within 30 calendar days. If it cannot meet that deadline, it may take one additional 30-day extension, but it must provide the patient a written explanation and expected completion date within the initial 30 days. See HHS guidance on the individual right of access.

The Security Rule applies to electronic PHI (ePHI). It requires covered entities to use reasonable and appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of that information. Administrative safeguards include assigning security responsibility, managing workforce access, providing security training, responding to incidents, and conducting a risk analysis.

The rules are distinct, but they work together. A lost record can create an access problem under the Privacy Rule and raise questions about safeguards under the Security Rule. A practice needs processes for both, not just antivirus software or a general HIPAA policy.

A PRACTICAL HIPAA BASELINE FOR A SMALL PRACTICE

A small team does not need a hospital-sized compliance department. It does need clear responsibilities, usable procedures, and evidence that staff follow them.

Start with these essentials:

Write practical policies and procedures. Cover patient access requests, workforce access to records, incident reporting, device handling, backups, and vendor responsibilities. Keep them tailored to how your practice actually operates.
Assign privacy and security responsibility. Name a privacy official and a security official, and make sure staff know how to reach them. One person may handle both roles in a small practice, but the responsibilities still need to be assigned and understood.
Train your workforce, and keep completion records. Staff should know how to route a patient request, protect records, report a suspected incident, and follow access rules. Keep evidence of training and refresh it when roles, systems, or procedures change.
Track patient access requests. Log when each request arrives, who owns it, which records are needed, and the response deadline. Coordinate promptly with your EHR vendor or other business associate. Document the response or any legally permitted denial.
Perform a security risk analysis. Identify where ePHI is created, received, stored, or transmitted; assess threats and vulnerabilities; document gaps; and assign corrective actions. HHS explains the expectation in its risk analysis guidance.
Keep evidence that controls are working. Save policy approvals, training records, request logs, access reviews, risk-analysis findings, and remediation decisions. Documentation should reflect real practice, not simply a completed template.

A patient-access workflow can be simple: receive and record the request, verify identity and authority, identify the records and format requested, assign an owner, track the deadline, deliver securely, and retain proof of completion. The key is consistency. Staff should not have to invent the process each time.

A POLICY IS ONLY A SAFEGUARD IF PEOPLE USE IT

Having a binder of policies does not, by itself, demonstrate that a practice has implemented them. OCR may look for evidence that procedures were communicated, staff received training, responsibilities were assigned, and the practice followed its own process.

For example, an access-request policy should match what actually happens when a request comes in. Who receives it? Who checks the deadline? Who contacts the records vendor? What happens if the employee responsible is out? If the answers depend on memory or informal handoffs, the process may fail when the practice is under pressure.

Keep procedures straightforward enough for staff to use, and review them periodically. Update them when staffing, systems, vendors, or workflows change. A policy no one follows is not a safeguard.

THE PROPOSED SECURITY RULE UPDATE IS NOT A REASON TO WAIT

HHS has proposed changes to the HIPAA Security Rule that would make certain cybersecurity requirements more specific, including requirements concerning asset inventories, ePHI mapping, risk analysis, and security controls. The proposal is not yet a final rule. As of October 12, 2026, the current Security Rule remains in effect; the proposed changes do not replace current obligations. Read the proposed rule in the Federal Register.

For a small provider, the practical move is to address current gaps now. A clear inventory of systems that handle ePHI, a documented risk analysis, assigned action owners, and staff who understand their responsibilities can support today’s requirements while helping the practice prepare for potential changes.

Cenova Cyber provides HIPAA compliance and security support, including security risk assessments and remediation guidance. Our vCISO services can also help practices establish accountability, prioritize risk, and connect compliance work to business operations.

SMALL PRACTICES ARE NOT TOO SMALL FOR ENFORCEMENT

The Shen Smiles settlement does not mean every compliance gap will lead to a penalty of the same size. It does show that small practices remain accountable, and that missing policies and safeguards can become enforcement issues even without a sophisticated technical failure.

Build procedures your team can use. Assign clear ownership. Train staff and document completion. Track access requests against the 30-day deadline. Conduct a risk analysis and follow through on corrective actions.

Contact Cenova Cyber today for a free HIPAA compliance consultation. We’ll help you identify practical next steps to strengthen your safeguards and support your practice’s compliance program.