What happened
On October 8, 2026, the HHS Office for Civil Rights announced a settlement with Dr. Linda L. Shen d/b/a Shen Smiles, P.C. The release describes the practice as a Pennsylvania based provider that offers dental services. HHS counted the matter as its 56th action under the Right of Access Enforcement Initiative.
OCR said it received a complaint that the practice did not give an individual timely access to her protected health information despite multiple requests. The practice told OCR it could not provide access because a workforce member had taken the records. OCR determined that the practice had not implemented required policies and procedures, including right of access policies, and had not reasonably safeguarded PHI against uses or disclosures that would violate the Privacy Rule.
The practice agreed to pay $140,000 under a resolution agreement signed August 11, 2026. The resolution agreement, which HHS publishes alongside the release, states that it is not an admission of liability. The release as published does not state the length of a corrective action plan.
What we have not verified
The release does not give the number or dates of the individual’s requests, and it does not describe which specific safeguards OCR found missing. We are not filling those gaps.
Analysis: Two separate duties show up in this one matter. The first is a process for answering access requests. The second is keeping records safe enough that they can be produced when someone asks. A clinic that cannot locate a record has a second problem on top of a late response. For an ABA clinic, requests tend to arrive from parents and guardians at moments that matter to them, such as a change of provider or a school or insurer question, and the clinic has to be able to answer them from records it can actually find. A written access procedure and records that are controlled and recoverable are the two things this settlement points at. This is reporting, not legal advice.
About the settlement figure: it is the amount paid to OCR. It does not include the entity's own costs of responding, such as staff time, outside advisers and remediation, or any private claims.
Compliance you can actually show.
WiseUpHIPAA is built for ABA clinics. It works out what applies to you, holds your decisions and the evidence behind them, and shows you honestly where you stand, including the parts that are not done yet.