Client Notice: OCR Settles Dental Practice HIPAA Right of Access Case for $140,000
By: Nicole M. Thorn, Esq.
The U.S. Department of Health and Human Services Office for Civil Rights (OCR) has announced a $140,000 settlement with Dr. Linda L. Shen, d/b/a Shen Smiles, P.C., a Pennsylvania dental practice, over alleged HIPAA Privacy Rule violations. The matter arose after a patient complained that the practice failed to provide timely access to requested medical records. According to OCR, the practice asserted that a workforce member had stolen the records. However, OCR's investigation found deficiencies in the practice's HIPAA compliance program, including the absence of right of access policies and procedures and inadequate safeguards for protected health information (PHI). This action marks OCR's 56th Right of Access enforcement case and reinforces several key compliance lessons for dental providers:
Patients generally must be given access to their records within 30 days of a request (with one permissible 30-day extension in limited circumstances).
Written HIPAA policies and procedures, including right of access protocols, remain a regulatory priority.
Practices must implement reasonable safeguards to protect PHI from theft, loss, or unauthorized disclosure.
Workforce misconduct does not eliminate a covered entity's HIPAA compliance obligations.
Dental practices should use this enforcement action as a reminder to review HIPAA policies, workforce training programs, and patient record request procedures to ensure ongoing compliance. If you or your practice need assistance in developing or preparing these policies and programs, please reach out.
The information in this article is for informational purposes. It is not legal advice. You should contact a licensed attorney before taking any actions or refraining from any actions based on the information provided here.
Comments