HIPAA Right of Access Enforcement Action: Settlement Highlights Risks of Inadequate Policies, Safeguards, and Training
On October 8, 2026, the U.S. Department of Health and Human Services Office for Civil Rights (OCR) announced a resolution agreement with a solo Pennsylvania dental practice resolving an investigation into potential violations of the HIPAA Privacy Rule. The covered entity paid $140,000. This settlement is OCR’s 56th enforcement action under its Right of Access Initiative, which addresses failures to provide individuals with timely access to their protected health information (PHI). The case began with a patient access complaint and expanded into findings concerning foundational compliance elements, including the absence of required policies, inadequate physical safeguards, and lack of workforce training.
The outcome demonstrates that even small covered entities, including solo practices, face meaningful enforcement exposure when administrative requirements are not met. A single complaint can open a broader review of an organization’s HIPAA program. For HIPAA regulated entities, the case provides concrete illustrations of the operational expectations that accompany a patient’s right of access.
The HIPAA Right of Access Requirement
Under the HIPAA Privacy Rule, individuals have the right to inspect and obtain a copy of PHI about them that is maintained in a designated record set. Covered entities must provide the requested access within 30 days of receiving the request. One 30-day extension is available if the entity notifies the individual in writing of the reasons for the delay and the expected completion date.
The Investigation
OCR received a complaint on April 21, 2020, from an attorney representing a former patient. The complaint alleged that the dental practice had failed to provide the individual with access to her PHI despite multiple requests. OCR notified the practice and requested relevant documentation, including policies and procedures governing individual access requests.
The practice responded that it could not produce the records because a workforce member had stolen them.
OCR’s investigation determined that the practice had not implemented policies and procedures designed to comply with the Privacy Rule and the Breach Notification Rule. Specifically, the practice lacked written policies addressing the right of access.
The investigation further found that the practice did not reasonably safeguard PHI from intentional or unintentional uses or disclosures. In particular, patient records were not maintained in order, were stored in unsecured locations, were sometimes difficult to locate when patients presented for appointments, and were occasionally carried between practice locations and to the dentist’s home.
The practice also confirmed that it had not provided formal HIPAA Privacy Rule training to its workforce members.
OCR identified two primary violations: failure to implement policies and procedures with respect to PHI under 45 C.F.R. § 164.530(i)(1), and failure to apply reasonable administrative safeguards to protect PHI under 45 C.F.R. § 164.530(c)(2)(i). Both violations were placed in the reasonable cause penalty tier. OCR calculated a potential civil money penalty of $1,400,000 before applying a 90 percent reduction based on the practice’s status as a small, rural provider. The reduction was intended to avoid jeopardizing the entity’s continued operations. The matter was resolved through a resolution agreement that included the $140,000 payment.
Implications for Covered Entities
Several practical lessons arise for HIPAA regulated entities of all sizes.
First, an access complaint frequently leads OCR to examine the entire compliance infrastructure rather than the single request. In this matter, the investigation extended beyond the timing of the records request to the existence of written policies, the physical security of records, workforce training, and the entity’s response to the reported theft of records. The theft allegation itself implicated potential Breach Notification Rule obligations. Covered entities that cannot locate or produce records when requested may face scrutiny of the systems that are supposed to make production possible.
Second, the absence of written policies is itself a violation, independent of whether a particular request was ultimately fulfilled. Policies and procedures must address the right of access, including the method for receiving and logging requests, the timeline for response, the calculation of any fees, the handling of requests from personal representatives, and the process for documenting fulfillment or denial. Policies should also address related administrative requirements, such as workforce training and the investigation of potential incidents involving PHI.
Third, reasonable safeguards apply to paper records as well as electronic PHI. Covered entities that maintain paper charts must store them in a manner that limits unauthorized access. This typically includes locked storage, controlled access to the area where records are kept, and procedures for tracking the location of charts. When records are transported between locations, additional controls are needed. Frequent inability to locate records when patients arrive for care is evidence that safeguards and inventory practices are insufficient.
Fourth, workforce training is a required element of the Privacy Rule’s administrative safeguards. Training should cover the right of access, the proper handling of PHI, and the obligation to report suspected incidents. Training must be documented. The lack of formal training can support findings of noncompliance even when individual staff members attempt to respond to requests in good faith.
Fifth, size and location may affect the final penalty amount but do not eliminate liability. OCR applied a substantial reduction because the practice was small and located in a rural area. The reduction did not, however, result in dismissal of the matter. Covered entities cannot rely on limited resources as a complete defense to the absence of required policies or basic safeguards.
Practical Steps to Strengthen Right of Access Compliance
Develop and Maintain Written Right of Access Policies
Develop and maintain written policies and procedures that specifically address the right of access. The policies should identify the privacy official or other designated individual responsible for receiving requests, set internal deadlines that allow the entity to meet the 30-day regulatory timeline, describe how fees will be calculated and communicated, and establish a method for documenting the date of receipt, the scope of the request, any extension, and the date and method of fulfillment.
Implement Appropriate Physical Safeguards for PHI
Implement physical safeguards appropriate to the volume and form of PHI maintained. For paper records, this includes locked cabinets or rooms, limited key or badge access, and a system for checking records in and out. Periodic inventories can help identify missing charts before a patient access request is made.
Provide Documented Workforce Training
Provide initial and periodic training to all workforce members on the Privacy Rule, with particular attention to individual rights and the handling of access requests. Document attendance and the content covered. Include scenarios that address common issues, such as requests received by telephone, requests from personal representatives, and situations in which records cannot be immediately located.
Establish Incident Investigation Processes
Establish a process for investigating potential incidents involving PHI, including alleged theft or loss of records. Document the investigation, the determination of whether a breach occurred, and any notifications required under the Breach Notification Rule. Failure to investigate and document can compound the original access issue.
Maintain an Access Request Log
Maintain a log of access requests that captures the date of receipt, the identity of the requestor, the records requested, the date of response, and any fees charged. The log provides evidence of timely compliance and can help identify patterns that require process improvements.
Conduct Periodic Internal Compliance Reviews
Conduct periodic internal reviews of access request handling and record storage practices. Reviews can be performed by the privacy official or by an external consultant. The goal is to identify any gaps and close them.
Closing Remarks
HIPAA regulated entities should treat the right of access as an operational process supported by documented procedures, secure record systems, and trained personnel. Entities that have not recently reviewed their policies, training records, and physical safeguards for paper and electronic PHI may benefit from doing so promptly. Clear processes and documentation not only support compliance but also demonstrate good-faith efforts if OCR later reviews an access request.
Sources: HHS Press Release – HHS OCR Settles HIPAA Privacy Rule Investigation with Dr. Linda L. Shen d/b/a Shen Smiles, P.C.; Notice of Proposed Determination - Dr. Linda L. Shen d/b/a Shen Smiles, P.C.; OCR Shen Smiles Resolution Agreement
If you would like to explore how Venus Caruso can assist with your HIPAA compliance needs, reach out to schedule a complimentary consultation using the contact form.
This post provides general information only. It is not, and should not be, construed as legal advice or a legal opinion on any particular matter or set of facts. Reading this post does not create an attorney-client relationship. Laws and regulations can change, and specific situations may require different approaches. Do not act or refrain from acting based solely on this post. Always consult a qualified attorney for advice tailored to your specific circumstances.
