Sometimes it begins with one patient asking for records. Sometimes the medical practice itself contacts the HHS Office for Civil Rights because it is having a problem with a vendor.
Two OCR enforcement cases involving solo healthcare practices illustrate an important point: once OCR begins looking at an issue, the review may not stop with the issue that brought the agency in.
In both cases below, the original problem was different from the compliance deficiencies that ultimately led to six-figure settlements. One practice paid $140,000. The other paid $100,000 and spent two years operating under an OCR-monitored corrective action plan.
Case 1: A Patient Records Request Leads to a $140,000 Settlement
Shen Smiles, P.C. was a solo general dentistry practice in rural Pennsylvania with about 10 employees. The practice was a HIPAA covered entity because it electronically billed insurers, including Pennsylvania Medicaid.
The case began in April 2020 when a former patient's attorney complained to OCR that the practice had not provided the patient's records after repeated requests. OCR's initial data request did more than ask what happened with those records. It also requested the practice's written right-of-access policies.
The practice objected to the request. Later, Dr. Linda Shen submitted a sworn statement saying that most of the requested records no longer existed at the practice because a former employee had taken them. That changed the direction of the investigation.
OCR requested policies dealing with safeguards, uses and disclosures of protected health information, and breach notification. The practice responded “None” to each of those policy requests.
What OCR found
OCR found that patient records were not being adequately safeguarded. Records were stored in clear plastic boxes, on floors and in boxes in a private bathroom. Records were transported between offices and to Dr. Shen's home, and employees had not received formal HIPAA Privacy Rule training.
OCR ultimately cited two violations:
- failure to maintain policies and procedures designed to comply with the HIPAA Privacy Rule and Breach Notification Rule; and
- failure to reasonably safeguard protected health information from intentional or unintentional use or disclosure.
Importantly, OCR did not charge Shen Smiles with a right-of-access violation. The agency accepted the sworn statement that the requested records no longer existed and therefore did not pursue that allegation.
The records complaint brought OCR into the practice. It was the other compliance deficiencies OCR discovered that became the enforcement findings.
How $1.4 million became $140,000
OCR calculated an unmitigated maximum penalty of $1.4 million for the two violations over the period it examined.
Because Shen Smiles was a small rural practice, OCR reduced the amount by 90%, specifically taking into account the size of the practice and the potential financial impact on a rural healthcare provider. The resulting proposed penalty was still $140,000.
The practice requested a hearing and ultimately settled with HHS in August 2026 for the same $140,000 amount. The settlement did not include an OCR corrective action plan.
What this settlement does — and does not — tell us
The $140,000 settlement resolves only the identified Privacy Rule findings. The published record does not show a Security Rule finding, and it does not tell us that the practice's Security Rule documentation and controls were adequate.
Given the documented policy gaps, it is reasonable to ask whether other HIPAA documentation may also have been incomplete. But that is not established in the public record.
We also do not know from the published documents whether OCR's review of the practice is completely finished.
Case 2: The Practice Asked OCR for Help With Its Vendor — and OCR Examined the Practice
The second case, resolved in 2020, is older, but it is particularly relevant to small medical practices using cloud-hosted EHR systems.
Steven A. Porter, M.D., P.C. was a solo gastroenterology practice in Ogden, Utah serving more than 3,000 patients per year. Its electronic health records were maintained by an outside EHR company.
In 2013, the practice itself contacted OCR because it was having a problem with a vendor. It reported that Elevation43, a business associate of its EHR company, was blocking the practice's access to patient information until Dr. Porter paid $50,000. In practical terms, the practice went to OCR because it believed a vendor was holding its patient information hostage.
OCR looked at the practice too
OCR opened a compliance review of Dr. Porter's practice.
The review found that the practice had never conducted an accurate and thorough HIPAA Security Risk Analysis. OCR also reported that, despite significant technical assistance during the investigation, the practice still did not complete an adequate risk analysis.
OCR also found that the practice had allowed its EHR company to create, receive, maintain or transmit electronic protected health information on its behalf without a business associate agreement.
The vendor dispute had brought the practice to OCR. The enforcement findings were about the practice's own HIPAA Security Rule obligations.
The Cost Was More Than $100,000
Dr. Porter's practice entered into a $100,000 settlement with OCR. But the check was only part of the consequence.
The practice also entered into a two-year corrective action plan monitored by OCR. Among other requirements, the corrective action plan required the practice to:
- create an inventory of equipment, systems and applications containing ePHI;
- conduct a Security Risk Analysis and submit it to OCR for approval;
- create and implement an OCR-reviewed risk management plan;
- develop business-associate policies and procedures;
- put the appropriate business associate agreement in place with the EHR company;
- train workforce members;
- investigate and report specified compliance events; and
- submit implementation and annual reports to OCR.
This is an important distinction in enforcement cases: the settlement amount may not represent the full operational cost of the problem.
What These Two Cases Have in Common
The facts are different, and the applicable HIPAA rules are different. Shen Smiles was a Privacy Rule case involving written policies and safeguards for patient records. Porter was a Security Rule case involving risk analysis, risk management and a business associate relationship. But together they illustrate several lessons for small medical practices.
Small practices are not outside OCR's reach
Both were solo practices. Shen Smiles had about 10 employees. A small headcount does not eliminate the obligation to maintain the policies, safeguards and documentation required by HIPAA.
An investigation does not have to start with a cyberattack
Neither case involved ransomware or a large hacking incident. One began with a patient's records complaint. The other began when the practice itself reported a problem involving a vendor.
The original problem may only open the door
In neither case did the final enforcement findings simply mirror the issue that initiated OCR's involvement. Once OCR reviewed the practices' compliance programs, other deficiencies became significant.
A cloud EHR does not transfer HIPAA responsibility to the vendor
The Porter case is especially relevant to practices that rely heavily on a cloud-hosted EHR. The vendor may store the records and operate the platform, but the covered entity still has its own responsibilities.
In Porter, the practice was cited for its own missing risk analysis and its failure to have the required business associate agreement with its EHR company.
Could Your Practice Produce These Today?
One practical way to look at these cases is not to ask, “Could that happen to us?” Ask instead:
If OCR contacted us tomorrow, could we produce the documentation it would expect to see?
Based on the records requested or deficiencies identified in these two cases, that may include:
- a current written Security Risk Analysis covering systems that create, receive, maintain or transmit ePHI;
- a documented risk management plan showing how identified risks are being addressed;
- signed business associate agreements with appropriate vendors, including the EHR provider;
- written HIPAA Privacy Rule policies;
- written breach-notification policies and incident records;
- evidence of workforce training and enforcement; and
- appropriate physical safeguards for paper records.
Not every item above falls within an IT provider's scope, but the practice should know who is responsible for each one and whether the documentation actually exists.
Where GO InfoTek Fits
GO InfoTek's compliance work focuses on the HIPAA Security Rule and the security-side components of breach response.
That includes areas such as Security Risk Analysis, risk management, technical safeguards, cybersecurity, vendor-security considerations and supporting security documentation.
Privacy Rule operational compliance and legal determinations are outside GO InfoTek's scope and should be addressed with healthcare counsel or a qualified Privacy Rule specialist.
That distinction is particularly important here: the Shen Smiles findings were Privacy Rule findings, while the Porter findings were Security Rule findings.
The Practical Lesson
A small medical practice does not need to experience a major cyberattack before its HIPAA program is tested.
A patient complaint, a vendor dispute, an incident report or another routine interaction with OCR can lead to questions about policies, risk analysis, business associate agreements, safeguards, training and documentation.
The best time to discover that one of those pieces is missing is before OCR asks for it.
This article provides general information to support technology, cybersecurity and compliance discussions. It is not legal advice and does not replace review of your organization’s specific obligations with qualified legal or compliance professionals.
