OCR settles HIPAA case with Shen Smiles
HHS OCR resolved a HIPAA privacy investigation with Shen Smiles, a Pennsylvania dental provider, for $140,000.
The U.S. Department of Health and Human Services, through its Office for Civil Rights (OCR), announced a resolution agreement with Shen Smiles, a Pennsylvania dental provider, over possible HIPAA Privacy Rule violations. The provider will pay $140,000 after an investigation found it lacked adequate policies and procedures for access to protected health information and did not reasonably safeguard that data from improper use or disclosure.
The U.S. Department of Health and Human Services, through its Office for Civil Rights (OCR), announced a resolution agreement with Shen Smiles, a Pennsylvania dental provider, over potential violations of the HIPAA Privacy Rule. The investigation found that the provider did not have adequate policies and procedures for access to protected health information and did not reasonably safeguard that information from improper use or disclosure. The agreement requires a $140,000 payment to OCR.
What did OCR determine about Shen Smiles?
OCR concluded that Shen Smiles lacked adequate controls to manage access to protected health information and had not reasonably protected that data from improper use or disclosure, according to the official HHS notice. That finding formed the basis of the financial settlement.
HHS disclosed the case on October 8, 2026. The following day, HIPAA Journal reported that it was the 56th monetary penalty action under OCR's access initiative.
What other details did HIPAA Journal report?
According to HIPAA Journal, OCR identified alleged violations tied to 45 C.F.R. §§ 164.530(c), 164.502(a), and 164.404 through 164.408, along with issues related to the implementation of policies and procedures and administrative safeguards. That reference does not appear as an official confirmation in the material provided, so it should be treated as attribution to that publication.
The same report said OCR initially calculated a maximum penalty of $1.4 million, with $700,000 for each of two violations, then applied a 90% reduction because of the entity's size, which the publication described as a small rural healthcare provider. HIPAA Journal also said Shen Smiles requested a hearing before an administrative judge, and that the settlement was reached before that stage.
What place does this case hold in OCR enforcement?
According to HIPAA Journal, the Shen Smiles matter was the 56th penalty action under OCR's access initiative. The publication also attributed to the agency a cumulative total of $3,170,250 in HIPAA penalties during 2026, as of October 9.
The HHS material provided did not include that cumulative figure or the details of the initial penalty calculation. For that reason, those data points are limited to what HIPAA Journal reported.
Sources
- Shen Smiles Pays $140,000 to Resolve HIPAA Privacy Rule Violationshipaajournal.com· HIPAA Journal
- HHS' Office for Civil Rights Settles HIPAA Privacy Rule Investigation with Pennsylvania Dental Provider for Failure to Provide Timely Access to Patient Recordshhs.gov· U.S. Department of Health and Human Services, Office for Civil Rights
