November 4, 2026
When OCR Looks Deeper: What Recent HIPAA Settlements Mean for Medical and Dental Practices
- by Shanon Moore, Director, OSHA/HIPAA Compliance
For many medical and dental practices, maintaining HIPAA compliance is one of many responsibilities competing for time and attention. Policies are established, employees complete training, and technology vendors help manage information security. While these measures are important, recent enforcement activity from the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) reinforces the need for ongoing oversight and documentation.
Recent settlements also demonstrate that smaller healthcare organizations are not exempt from regulatory scrutiny. More importantly, an investigation that begins with a single patient complaint or security incident may uncover broader deficiencies in a practice’s HIPAA compliance program.
Understanding what prompted these investigations and the findings that followed can help practices evaluate their own compliance efforts and identify opportunities for improvement.
A Patient Complaint Leads to Broader Compliance Findings
In October 2026, OCR announced a $140,000 settlement with Shen Smiles, P.C., a solo dental practice in Pennsylvania, following an investigation that began with a patient’s complaint regarding access to her medical records.
The patient alleged that the practice failed to provide timely access to her protected health information (PHI) despite multiple requests. During the investigation, the practice reported that it could not provide the requested records because a workforce member had allegedly taken records from the practice.
As OCR examined the circumstances surrounding the complaint, investigators identified additional concerns involving the practice’s HIPAA compliance. These included failures to implement appropriate Privacy and Breach Notification Rule policies and procedures and to reasonably safeguard PHI from impermissible uses or disclosures.
The resulting settlement illustrates how an issue involving a single patient can lead to a more comprehensive review of an organization’s compliance practices.
For smaller medical and dental practices, the implications extend beyond the financial penalty. An investigation may reveal gaps in policies, employee training, documentation, or everyday procedures that have gone unaddressed.
Security Incidents Bring Additional Scrutiny to Risk Analysis
While the Shen Smiles investigation focused on HIPAA Privacy Rule concerns, recent cybersecurity-related settlements highlight another area receiving significant attention from OCR , the Security Risk Analysis (SRA).
In February 2026, OCR announced a $103,000 settlement with Top of the World Ranch Treatment Center, a substance use disorder treatment provider, following a phishing incident involving the electronic protected health information (ePHI) of approximately 1,980 individuals.
During its investigation, OCR determined that the organization had failed to conduct an accurate and thorough assessment of potential risks and vulnerabilities to its ePHI. The settlement marked OCR’s 11th enforcement action under its Risk Analysis Initiative, which focuses on compliance with the HIPAA Security Rule’s risk analysis requirement.
In addition to the financial settlement, the organization agreed to a corrective action plan that included conducting a comprehensive risk analysis, developing a risk management plan, reviewing policies and procedures, and providing workforce training. OCR will monitor compliance with the corrective action plan for two years.
A similar investigation involved Comprehensive Neurology, P.C., a small New York neurology practice that experienced a ransomware attack affecting approximately 6,800 individuals.
In 2025, OCR announced a $25,000 settlement after determining that the practice had failed to conduct an accurate and thorough Security Risk Analysis. The practice also agreed to a two-year corrective action plan.
Together, these settlements demonstrate that OCR’s focus on risk analysis extends to smaller healthcare organizations, including those experiencing security incidents involving relatively limited numbers of patients. They also reinforce the importance of evaluating security risks before an incident occurs rather than attempting to address compliance deficiencies during an investigation.
Understanding the Security Risk Analysis Requirement
With proposed changes to the HIPAA Security Rule receiving considerable attention, it is important to distinguish between existing requirements and potential future obligations. The requirement to conduct an accurate and thorough Security Risk Analysis is already established under the HIPAA Security Rule.
Covered entities and business associates must assess potential risks and vulnerabilities to the confidentiality, integrity, and availability of the ePHI they create, receive, maintain, or transmit. An effective SRA provides an organization with a clearer understanding of where sensitive information resides, how it is accessed and protected, and what vulnerabilities could place that information at risk.
The assessment should consider several important elements:
- Systems and technology: Identifying applications, devices, networks, and systems that create, receive, maintain, or transmit ePHI.
- Third-party relationships: Evaluating vendors and service providers that access, maintain, or otherwise interact with ePHI.
- Potential threats and vulnerabilities: Identifying circumstances that could result in unauthorized access, disclosure, modification, or loss of information.
- Existing safeguards: Reviewing administrative, physical, and technical protections currently in place.
- Risk evaluation: Assessing the likelihood and potential impact of identified threats and vulnerabilities.
- Risk management: Establishing a documented approach to addressing identified risks and monitoring remediation efforts.
The SRA is intended to be more than a completed questionnaire or a document maintained for regulatory purposes. Its value lies in helping practice leadership understand potential exposures and make informed decisions about appropriate safeguards.
An equally important component is the risk management process that follows. Identifying vulnerabilities is only the first step. Organizations should document how identified risks will be addressed, assign responsibility where appropriate, and monitor progress toward remediation.
Proposed Security Rule Changes and an Updated Regulatory Timeline
HHS has proposed significant revisions to the HIPAA Security Rule that would establish more detailed cybersecurity requirements for covered entities and business associates.
In its updated regulatory agenda, HHS postponed its anticipated final action on the proposed amendments from May 2026 to July 2027. The rulemaking was also moved to the agency’s long-term regulatory agenda, indicating that the changes may take longer to finalize than originally anticipated.
It is important to recognize that July 2027 represents a projected date for final regulatory action, not a compliance deadline. The final requirements and their implementation timeline will not be known until a final rule is published.
Among the proposed requirements are:
- Maintaining a comprehensive technology asset inventory and network map.
- Expanding documentation requirements associated with security risk analyses.
- Conducting a Security Rule compliance audit at least annually.
- Performing vulnerability scanning at least every six months.
- Conducting penetration testing at least annually.
- Implementing multi-factor authentication and encryption, subject to limited exceptions.
- Strengthening incident response, contingency planning, and system recovery requirements.
These provisions remain proposed and are not currently enforceable requirements. The existing HIPAA Security Rule continues to apply while the rulemaking process moves forward.
Although the revised timeline may provide organizations with additional time to prepare for potential changes, it does not postpone existing compliance obligations.
OCR’s recent enforcement actions demonstrate that practices should not delay their compliance efforts while awaiting a final rule. Conducting an accurate and thorough Security Risk Analysis and maintaining an appropriate risk management process remain fundamental requirements today.
Maintaining Compliance Beyond Cybersecurity
Although cybersecurity remains a significant concern for healthcare organizations, the Shen Smiles settlement serves as a reminder that HIPAA compliance encompasses much more than information technology.
Patient access rights, privacy policies, workforce training, appropriate handling of PHI, breach response procedures, and documentation all contribute to an effective compliance program.
For example, a practice may have strong technical safeguards but still encounter compliance concerns if employees are unfamiliar with patient access requirements or if established privacy procedures are not consistently followed. Likewise, maintaining an updated HIPAA policy manual does not replace the need to assess security risks associated with electronic health records, cloud applications, remote access, and third-party vendors.
Effective compliance requires coordination between administrative leadership, privacy and security personnel, employees, and technology providers. This is particularly important for practices with multiple locations or those that have experienced growth, changes in staffing, or the introduction of new technology. Procedures that were appropriate several years ago may no longer reflect the organization’s current operations.
Practical Steps for Medical and Dental Practices
Recent enforcement activity provides an opportunity for practices to evaluate their existing HIPAA compliance efforts and identify areas that may benefit from additional attention.
Several practical steps can help strengthen compliance and reduce potential exposure.
- Review the most recent Security Risk Analysis. Determine whether the assessment accurately reflects the organization’s current technology, locations, applications, vendors, and operational processes. Significant changes to systems or the environment may warrant an updated analysis.
- Evaluate progress on identified risks. Review the risk management plan associated with the assessment. Confirm that remediation efforts have been documented, outstanding risks are being monitored, and appropriate individuals are responsible for follow-up.
- Revisit HIPAA policies and procedures. Ensure that written policies address current regulatory requirements and reflect how the organization operates. Pay particular attention to patient access requests, privacy safeguards, incident reporting, and workforce responsibilities.
- Reinforce employee training and awareness. Employees should understand how HIPAA requirements apply to their daily responsibilities. Training should be supported by clear procedures, appropriate documentation, and ongoing communication.
- Review third-party relationships and technology changes. New vendors, electronic health record integrations, cloud-based services, remote access capabilities, and other technology changes can introduce additional risks. These relationships and systems should be considered as part of the organization’s security oversight.
- Maintain accessible compliance documentation. Practices should be prepared to demonstrate their compliance efforts through policies, training records, risk assessments, remediation documentation, and other supporting materials.
These steps can help organizations establish a more consistent approach to compliance while identifying potential concerns before they lead to an incident or regulatory investigation.
A Proactive Approach to HIPAA Compliance
No medical or dental practice can eliminate every possibility of a patient complaint, employee error, phishing attack, ransomware incident, or third-party breach. However, organizations can take meaningful steps to reduce risks and demonstrate their commitment to protecting patient information.
Recent OCR settlements illustrate the potential consequences of compliance gaps, particularly when an investigation expands beyond the incident that initially prompted regulatory attention.
For smaller practices, the impact may include not only financial penalties but also legal expenses, remediation costs, operational disruption, workforce retraining, and ongoing regulatory monitoring.
A proactive compliance program provides a more effective approach. Regular policy reviews, workforce education, comprehensive Security Risk Analyses, and documented risk management efforts help organizations identify weaknesses and strengthen safeguards over time.
Ultimately, HIPAA compliance should be viewed as an ongoing process that supports patient trust, operational stability, and responsible information management.
How DoctorsManagement Can Help
DoctorsManagement supports medical and dental practices in developing and maintaining practical HIPAA compliance programs tailored to their operations.
Our services include ongoing compliance guidance, policy and procedure development, employee training, compliance assessments, breach and incident support, and comprehensive Security Risk Analyses.
For practices that rely on internal IT personnel or third-party technology vendors, an independent SRA can provide an additional level of oversight by evaluating security risks from a HIPAA compliance perspective.
The assessment identifies potential vulnerabilities and provides a documented risk register to help practice leadership prioritize appropriate remediation efforts.
As regulatory expectations continue to evolve, maintaining an accurate understanding of your organization’s risks and compliance responsibilities is increasingly important.
Is Your Security Risk Analysis Current?
Recent OCR enforcement actions serve as an important reminder that maintaining HIPAA compliance requires ongoing attention, documentation, and an understanding of the risks facing your practice.
Whether your organization needs a comprehensive Security Risk Analysis, assistance addressing identified vulnerabilities, or guidance strengthening its overall HIPAA compliance program, DoctorsManagement can help.
Take the next step toward a more proactive compliance program.
Learn More About Our Security Risk Analysis Services
Explore DoctorsManagement’s OSHA & HIPAA Compliance Services
Our team is available to discuss your practice’s needs and help identify practical solutions that support compliance and protect patient information.
