Two HHS Office for Civil Rights (OCR) settlements this fall show what usually gets small practices in trouble. It's rarely an exotic hack. It's the basics: knowing where your records are, being able to hand a patient her chart, and actually reviewing who has been in your systems. On October 8, 2026, OCR announced a $140,000 settlement with Shen Smiles, P.C., a Pennsylvania dental practice, over a patient's records request. On October 29, OCR announced an $800,000 settlement and three-year corrective action plan with Lehigh Valley Health Network (LVHN) after a ransomware attack. One is a solo-practice dental case, the other is a health system, and the checklist for a small office is the same.
Shen Smiles: the records request that couldn't be answered
According to OCR's announcement, a patient complained that Shen Smiles did not give her timely access to her protected health information (PHI) "despite receiving multiple requests." During the investigation, the practice said it couldn't provide the records because a workforce member stole them from the practice. OCR found the practice did not have Privacy and Breach Notification Rule policies and procedures in place, including right-of-access procedures, and did not reasonably safeguard PHI from intentional or unintentional impermissible use or disclosure.
OCR issued a Notice of Proposed Determination on July 31, 2024. The practice requested a hearing before an administrative law judge. On August 11, 2026, before that hearing, the two sides signed a resolution agreement, and Shen Smiles agreed to pay $140,000. OCR calls it its 56th Right of Access enforcement action. The rule: patients get access to their records within 30 days, with one possible 30-day extension.
LVHN: ransomware, and the logs nobody reviewed
Per OCR's Oct. 29 announcement, LVHN discovered suspicious activity on February 4, 2023 that was later determined to be ransomware, and it filed a breach report on May 15, 2023. OCR says PHI of 248,359 people was exfiltrated and posted on the dark web. OCR found potential failures to:
- conduct an accurate and thorough risk analysis of all ePHI;
- regularly review information system activity such as audit logs, access reports and security incident tracking reports;
- prevent the impermissible disclosure of PHI;
- notify affected individuals on time; and
- notify the HHS Secretary on time.
LVHN paid $800,000 and agreed to a corrective action plan that OCR will monitor for three years. OCR calls it its 22nd ransomware enforcement action. "Failure to conduct an accurate and thorough risk analysis and to undertake regular review of information system activity makes regulated entities attractive targets for cyberattacks," OCR Director Paula M. Stannard said.
What we are not claiming: Both settlements resolve potential violations, and OCR's announcements are the source for every fact above. We are not adding anything about how the LVHN attackers got in, whether any ransom was paid, or what happened to the Shen Smiles records beyond what the practice told OCR. Neither case involves a Brotherly client.
Why this lands on a small practice's front desk
Most dental and medical offices we see don't have a written process for records requests. A request comes in by phone, email or the patient portal, someone means to get to it, and 30 days goes by. Records that live in several places make it worse: the practice management system, an old server, imaging software, a scanner folder, and a box of paper charts from the practice you bought. If you can't say where the chart is, you can't produce it on time, and you can't tell whether someone walked off with it. Audit logs are the same story. Most practice management and EHR systems record who opened what. Almost nobody looks at them until something goes wrong.
What to do this month
- Write a one-page records request procedure. Who receives requests, where they are logged (date received, date due, date fulfilled), who approves, what format you provide, and what you charge. Put the 30-day clock on the log itself.
- Map where PHI lives. Practice management or EHR, imaging, email, scanned documents, old servers, backups, paper. OCR's own list of recommended steps starts with knowing where ePHI is and how it enters, moves through and leaves your office.
- Lock down paper and departing staff. Locked storage for paper charts, a sign-out process for anything leaving the building, and same-day account shutoff and key return when someone leaves.
- Turn on and review audit logs. Pick a monthly date. Pull the access report from your practice management or EHR system and look for after-hours access, bulk exports and accounts that should not exist. Initial and file the review.
- Update your risk analysis. If it is more than a year old or was a template someone filled in once, redo it, and keep a written risk management plan with owners and dates. Both settlements trace back to missing basics.
- Know your breach clock. Have a short incident plan that names who decides whether something is a reportable breach and who notifies patients and HHS. Late notice was part of the LVHN findings.
- Train for your actual jobs. Front desk on records requests, clinical staff on access, and managers on audit review. OCR's recommendations call for training specific to each role.
The takeaway for practice owners
Neither settlement needed a sophisticated attacker to go wrong. Shen Smiles turned on a patient's records request, and LVHN on risk analysis, log review and late notice. A small practice can cover most of that with a written records process, a current risk analysis, and a monthly look at who opened what. If you want help mapping your PHI, setting up audit-log reviews, or getting your HIPAA paperwork current, Brotherly Technology can help.