Dental practice HIPAA paper records are where many small offices are most exposed, and a 2026 enforcement action makes the point bluntly. Dr. Linda L. Shen, owner of Shen Smiles, a Pennsylvania dental practice, agreed to pay a $140,000 civil money penalty to the HHS Office for Civil Rights, as reported by The HIPAA Journal in October 2026. There was no ransomware attack and no stolen laptop. The case started in April 2020 with a complaint from a patient’s attorney who said repeated requests for the patient’s records had gone unanswered. OCR’s investigation found charts stored in plastic boxes, on the floor and in a private bathroom, records regularly taken home, no formal HIPAA training for staff, and no written policies to show compliance. This article walks through what went wrong, how OCR calculated the penalty, and the practical records controls a small dental office can put in place this month.
Overview: Five Points Every Practice Owner Should Take From This Case
The Shen Smiles resolution is small by OCR standards, but it is unusually instructive for independent practices. These five points frame the rest of the article.
- A records request started it. One unanswered request from a patient’s attorney triggered a federal investigation that lasted years.
- Paper is regulated exactly like electronic data. The Privacy Rule applies to charts in a box the same way it applies to records in practice management software.
- Missing policies were the core violation. The penalty rested on the absence of written policies and administrative safeguards, not on proof that anyone misused patient data.
- Small size reduced the fine but did not remove it. OCR calculated a maximum of $1.4 million and applied a 90 percent reduction because the practice is small and rural.
- The fixes are inexpensive. Locked storage, a records log, a written access policy and annual training cost far less than the penalty, let alone the legal fees.
How a Records Request Turned Into a Federal Penalty
A records request becomes a federal penalty when a practice cannot produce the chart and cannot show the policies that should have protected it. Under the HIPAA right of access, patients and their personal representatives can request copies of their records, and practices generally must respond within 30 days. When a practice misses that window repeatedly, the patient or their attorney can file a complaint with OCR, which is exactly what happened here on April 21, 2020. OCR notified the practice on May 20, 2020, and began asking for documentation.
What the practice told investigators
According to the reported findings, Dr. Shen stated in an affidavit that the requested documents did not exist because a workforce member had stolen them, and later attributed the loss to a former office manager. That explanation created a second problem. If records were stolen, HIPAA required the practice to assess the incident as a possible breach and, where required, notify the patients involved. OCR cited the breach notification provisions alongside the Privacy Rule safeguards because the practice could not show it had done either.
What OCR found in the office
Investigators described records stored in unsecured places, including plastic boxes, the floor and a private bathroom. Charts were frequently carried to the owner’s home. Staff often could not find records when patients arrived for appointments. The former employee blamed for the loss was not disciplined, and no steps were taken to prevent a repeat. Employees had never received formal Privacy Rule training. Any one of these would draw a finding. Together they told OCR the practice had no functioning records program.
Why the investigation took six years
The complaint arrived in 2020 and the penalty was reported in 2026. Enforcement timelines this long are common when a covered entity cannot produce documents and the case moves toward a civil money penalty rather than a negotiated settlement. The practice reached a resolution before a hearing before an administrative law judge. Those years of correspondence, document requests and legal representation carry their own cost that never appears in the headline figure.
What HIPAA Administrative Safeguards Mean for Paper Charts
HIPAA administrative safeguards require every covered entity, including a two-chair dental office, to have written policies and reasonable measures that protect health information in any form. The Privacy Rule section OCR relied on, 45 CFR 164.530(c), requires appropriate administrative, technical and physical safeguards. Section 164.530(i) requires written policies and procedures. Neither section makes an exception for paper or for small practices, although the rule allows the measures to be scaled to the size of the organization.
Physical safeguards for charts and x-rays
Paper charts belong in a locked cabinet or a locked records room, with keys or codes limited to staff who need them. That sounds obvious, yet our team regularly finds charts stacked in hallways, sterilization rooms and staff break areas in busy practices that ran out of space years ago. Printed x-rays, insurance forms and lab slips need the same treatment. Moving older charts to secure offsite storage or scanning them into a properly protected system is often the fastest way to free up space and reduce exposure at once.
Policies that a regulator can read
A written policy is the evidence that a practice has thought about how records are handled. At minimum, a small practice needs a records access and storage policy, a right of access procedure with response timelines, a sanctions policy for workforce violations, and a breach assessment procedure. These can be short. What matters is that they exist, match how the office really works, and are reviewed at least once a year. Our HIPAA compliance audit checklist for healthcare lists the documents OCR asks for first.
Sanctions and accountability
The Privacy Rule requires covered entities to apply appropriate sanctions against workforce members who violate policies. In the Shen Smiles case, the employee blamed for the missing records faced no discipline. Regulators read that as a sign that policies, if they existed, were not enforced. A simple written sanctions scale, documented each time it is used, closes this gap.
How the OCR Civil Money Penalty Was Calculated
The OCR civil money penalty in this case reflects a reasonable cause finding, a two violation count and a large reduction for the practice’s size. OCR classified the violations as reasonable cause rather than willful neglect, which places them in a lower penalty tier. It calculated a maximum of $1,400,000, or $700,000 for each of the two violations, then reduced that by 90 percent because the full amount could threaten the practice’s ability to operate. The result was $140,000.
Why reasonable cause still costs real money
Reasonable cause means the practice knew or should have known about the violation but did not act with willful neglect. Many small practice owners assume that good intentions protect them from penalties. This case shows otherwise. A practice can avoid the willful neglect tier and still owe six figures if it cannot show that basic safeguards and policies were in place.
The size reduction is not guaranteed
OCR considered the practice’s small, rural setting and financial condition when reducing the penalty. That discretion is real but unpredictable. It depends on the documentation the practice provides and on OCR’s judgment. Practices should not plan around a 90 percent discount; they should plan around never needing one.
Costs the penalty figure leaves out
The $140,000 does not include attorney fees across a six year investigation, staff time spent responding to document requests, or the reputational effect of a public resolution on a practice that depends on local referrals. For a small office, those costs can rival the penalty. Our article on HIPAA Security Rule mistakes that cost SMBs covers similar hidden costs on the electronic side.
How to Fix Patient Record Request Handling and Storage This Month
Patient record request handling and storage can be fixed in a few weeks with clear ownership, simple tools and a short training session. The goal is a practice that can find any chart in minutes, answer any access request on time, and show a regulator written proof of both.
Build a records log and a request tracker
Start with a basic inventory: where charts are stored, which years are on site, which are offsite, and which have been scanned. Then create a request tracker, even a simple spreadsheet, that records each access request, the date received, the date fulfilled and who handled it. Set a calendar reminder at day 20 for anything still open. This one tool would likely have prevented the original complaint in this case.
Scan and secure older charts
Many practices hold paper charts that are rarely touched but must be retained under state law. Scanning them into a system with access controls, audit logs and encryption reduces the physical footprint and makes requests faster to fill. If you scan, store the images in a system that meets the Security Rule, and follow our healthcare data encryption standards guide for protecting them at rest. Our healthcare data management team helps practices plan this migration without disrupting the schedule.
Train every workforce member and keep the proof
Formal Privacy Rule training was missing entirely at Shen Smiles. Annual training for every employee, including front desk staff, hygienists and part-time help, covers how to store charts, how to handle access requests and how to report a missing record. Keep a signed attendance record each year. Pair training with an annual risk review; our piece on annual HIPAA risk assessment mistakes SMBs make explains how to keep that review useful rather than a box to tick.
Frequently Asked Questions
Does HIPAA apply to paper dental records?
Yes, the HIPAA Privacy Rule applies to protected health information in any form, including paper charts, printed x-rays and handwritten notes. Paper records need physical safeguards such as locked storage and limited access, along with written policies.
How long does a dental practice have to answer a records request?
Under the HIPAA right of access, a practice generally must respond within 30 days of the request, with one 30 day extension allowed if the patient is told why in writing. Many states set shorter deadlines, so check local law as well.
What happens if a patient’s records are stolen by an employee?
The practice must assess the incident as a possible breach, notify affected patients when required, and apply sanctions to the employee. Failing to do those steps can become its own violation, as it did in the Shen Smiles case.
Can a small practice really be fined by OCR?
Yes, OCR penalizes practices of every size. It may reduce a penalty based on size and financial condition, as it did here, but small practices still face penalties when they cannot show basic safeguards and policies.
What is the fastest HIPAA improvement for a paper-based office?
Locked storage for all charts and a written records request procedure with a tracker are the fastest improvements. Both cost little and directly address the issues that most often lead to complaints.
Who Is Behind This Guidance
Mindcore Technologies works with dental offices, medical practices and other healthcare organizations on HIPAA compliance, records management and the IT systems that support them. Our team has helped small practices move from boxes of paper charts to secure, searchable records, and has prepared them for audits with the policies and evidence regulators expect. You can see the scope of our healthcare IT and compliance work, and our cyber security audits cover both physical and technical safeguards. Mindcore is led by CEO Matt Rosenthal, who focuses on helping regulated organizations reduce compliance risk with practical controls that owners and auditors can both verify.
Get Your Dental Practice HIPAA Paper Records in Order
The Shen Smiles case shows that dental practice HIPAA paper records can lead to a six figure penalty without any hacker involved. A single unanswered records request started a federal investigation that found charts on floors and in a bathroom, no staff training, no sanctions and no written policies. OCR’s penalty rested on those administrative and policy gaps, and only the practice’s small size kept the figure from reaching seven digits. The fixes are within reach of any office: lock up charts, track every access request, scan and protect older records, write short policies that match daily practice, train everyone each year and keep the proof. If you are not sure your practice could produce a complete chart and a written records policy on request today, that is the place to start. Book a free strategy call and our team will help you assess your records handling, close the gaps OCR looks for first, and build a simple compliance routine your staff can keep.
