On October 8, the Office for Civil Rights (OCR) announced its 56th HIPAA Right of Access enforcement action: a $140,000 settlement with Shen Smiles, a Pennsylvania dental practice. The case shows how quickly a missed request can escalate under HIPAA.

When the dental practice looked for the patient’s records to send her a copy, they found an empty file drawer. Later, the Office for Civil Rights (OCR) became involved after the patient complained that they hadn’t received their records. The dental practice answered honestly and may have thought it was off the hook. They couldn’t provide the records because an employee stole them.

Shen Smiles’ defense sounded like a corporate twist on “the dog ate my homework.” But in the world of HIPAA compliance, you own the dog. By claiming an employee stole the file, they weren’t offering a valid excuse; they were highlighting their own weak access controls, missing safeguards, and inadequate employee oversight.

The explanation didn’t end the inquiry. It opened a second one.

The Right of Access Requirements

Under the HIPAA Privacy Rule, individuals have the right to inspect and obtain a copy of their protected health information (PHI) held in a “designated record set,” which generally includes medical and billing records and other records used to make decisions about their care. This applies to both covered entities and, through their agreements with covered entities, business associates.

A few basics every organization should have down:

• The clock is currently 30 days. A pending Privacy Rule change reduces this 30-day window to 15 days. You must act on a request within that time limit, with one extension available only if you give the individual a written explanation of the delay and a date by which you’ll respond.
• You must provide the records in the form and format requested, if they’re readily producible that way. That includes electronic copies when the records are kept electronically.
• You can charge only a reasonable, cost-based fee. That’s limited to things like copying labor, supplies, and postage. You can’t charge for searching for or retrieving the records, and you can’t withhold them because the patient owes a bill.
• You can’t create unreasonable barriers. Patients don’t have to explain why they want their records, and requirements like making someone come to your office in person to submit a request can cross the line.

Access requests are also among the most common complaints OCR receives, which is why the agency keeps enforcing this requirement so consistently.

What Happened at Shen Smiles

OCR opened its investigation after a patient complained that she had made multiple requests for her records and never received them. During the investigation, the practice explained that it couldn’t fulfill the requests because a workforce member had stolen the records.

OCR looked past the access request to the practice’s overall compliance program, and what it found was broader than a single missed deadline. The practice had not implemented policies and procedures designed to comply with the Privacy and Breach Notification Rules, and it had no right of access policies and procedures at all. OCR also found the practice hadn’t reasonably safeguarded PHI from impermissible use or disclosure.

The case didn’t resolve quickly. OCR proposed a civil money penalty in July 2024, the practice requested a hearing before an administrative law judge, and the matter ended with a resolution agreement in August 2026, more than two years later. OCR Director Paula Stannard emphasized in the announcement that the Privacy Rule’s administrative requirements aren’t just about preventing improper disclosures; they’re also what allow organizations to meet their obligations on individual rights like access.

HIPAA Compliance Strengthens the Whole Practice

Notice what happened at Shen Smiles. A defense meant to explain one failure became evidence of several others. “The records were stolen” invites questions: How did a workforce member get them? What controls limited access? Who noticed they were gone, and what did the practice do about it? What did your policies say should happen?

HIPAA compliance requires attention to detail throughout the organization. It requires a holistic approach. It’s not solely an IT function, an HR function, or the office manager’s responsibility. The right of access sits on top of the rest of your compliance program. You can’t reliably deliver records you don’t safeguard, and you can’t meet a deadline you never tracked.

Strengthen Your Right of Access Procedures

1. Put a right of access policy in writing. It should state who receives requests, who fulfills them, how identity is verified, and the deadlines. Shen Smiles didn’t have one.
2. Make sure every employee can recognize a request. Patients may ask the front desk, a nurse, or a billing clerk. If staff doesn’t know how to route those requests, the 30-day clock is already running.
3. Track every request with dates. Log when each request arrived, when it was fulfilled, and any extension notice you sent. That log is your proof if someone files a complaint.
4. Control who can access and remove records. Limit access to what each role needs, review access logs, and revoke access promptly when someone leaves.
5. Have a plan for lost or stolen records. If PHI goes missing, evaluate it under the Breach Notification Rule and take steps to recover or reconstruct what patients are entitled to see.
6. Train your workforce on all of it, and document the training.

What’s Ahead for the Privacy Rule

The rule that governs all of this may soon change. A long-pending Privacy Rule proposal would cut the response deadline from 30 days to 15, with a shorter extension as well, though it hasn’t been finalized and the current 30-day standard remains in effect. We covered the details in our post on the coming Privacy Rule changes. The practical point for now is that an organization that can reliably respond within 30 days, with a written process, trained staff, and tracked requests, is far better positioned to meet a 15-day deadline than one that’s scrambling today.

The HIPAA E-Tool^® includes Right of Access policies, forms, and tracking tools designed to help covered entities and business associates handle requests correctly and show their work if OCR asks.