OCR’s First Settlement in Three Weeks Isn’t About a Breach. It’s About a Records Request.

OCR’s first new HIPAA settlement in three weeks was not a cyberattack case. It was the 56th time the agency has acted over a patient who could not get her own records.

The short version

After two quiet weeks, OCR posted a new HIPAA settlement — and it is a useful one, because it is not a ransomware headline. On October 8, the HHS Office for Civil Rights announced a $140,000 settlement with a Pennsylvania dental practice over something far more ordinary than a cyberattack: a patient asked for her records, repeatedly, and did not get them. OCR calls it its fifty-sixth Right of Access enforcement action. If you track HIPAA risk only as “will we get hacked,” this is the reminder that many OCR settlements are administrative rather than technical — and this kind is almost entirely within your control.

Enforcement: what is actually on the record

On October 8, 2026, OCR announced a $140,000 settlement with Shen Smiles, P.C., a Pennsylvania dental practice, resolving a HIPAA Right of Access and Privacy Rule investigation. (The resolution agreement itself was signed in mid-August; OCR announced it this week — the signing date and the announcement date are not the same.) The case began with a complaint from an individual who said she had made multiple requests for her records and could not get timely access; the practice’s stated reason was that a workforce member had taken the records. OCR had earlier issued a proposed civil money penalty and the practice requested a hearing before an administrative law judge; the matter settled by resolution agreement ahead of that hearing. Alongside the payment, OCR’s investigation identified the absence of required Privacy Rule and Breach Notification policies and procedures — including no right-of-access policy — and a failure to reasonably safeguard protected health information.

This is OCR’s fifty-sixth Right of Access enforcement action, following the Azul Vision settlement in late August as the fifty-fifth. The initiative has produced a steady stream of settlements, and the pattern is consistent: a patient asks for their records, the organization does not deliver them in the right format within the required window, and a complaint turns into an enforcement file. The dollar figures are smaller than the security cases, but it is a trigger many organizations overlook because it feels like a front-desk task rather than a compliance risk.

For context — and only as context, because neither is new this week — the most recent prior OCR enforcement action on the record is the $700,000 Ambry Genetics settlement from September 17, a phishing case in which OCR cited a potential failure to conduct an accurate and thorough risk analysis, and, separately at the state level, a coalition of 44 state attorneys general announced a $2.3 million settlement with LabCorp on September 24. Those remain the recent high-dollar markers. This week’s action is a smaller number with a sharper lesson: a preventable enforcement risk is sitting in your records-request process.

Two enforcement lanes, and this week lit up the one people ignore

OCR runs two patterns worth planning around, and they are not the same.

The Right of Access Initiative — now at fifty-six actions — is the high-frequency lane. It turns on process: who handles a records request, in what format, and on what clock. Shen Smiles is a textbook entry — not a sophisticated attacker, just a request that went unanswered and a practice that had never written down how it was supposed to respond.

The Risk Analysis Initiative — the security-failure lane — is where the large dollar figures live, and its recurring finding is a missing or inadequate Security Risk Analysis: an organization that could not show a current, thorough, enterprise-wide analysis of where its electronic protected health information lives and how it is exposed. OCR does not publish a live counter, so we describe this as a sustained pattern rather than a precise tally, but the direction across its recent ransomware and health-plan resolutions is not ambiguous.

Nothing new landed in that security lane this week. What landed was a reminder that the other lane — the administrative, largely preventable one — is active too, and this week it was the lane that produced the settlement.

Breach portal: read the trend, not the week

The HHS breach portal — the public list of breaches affecting 500 or more individuals — is a searchable database that the tools available to us could not query for confirmed dated per-entity postings in this specific window, and we do not publish individual counts we cannot independently confirm. We are not going to put a precise national figure on 2026 here: the year-to-date numbers in circulation come from third-party compilations rather than an OCR-published statistic, they lag, and they do not always reconcile with one another. What those compilations consistently show, directionally, is that hacking and other IT incidents remain the leading category of large healthcare breaches and that business associates keep turning up in the largest events — the same lesson the enforcement record keeps teaching: external intrusion and vendor exposure are where attention belongs.

The 2026 Security Rule: still proposed, still not law

For anyone being told they must already comply with “the new 2026 HIPAA Security Rule”: that rule is still a proposal, and nothing about its status changed this week. The current Security Rule remains the one in effect. The Notice of Proposed Rulemaking was published in the Federal Register in January 2025, the comment period closed in March 2025 after more than 4,700 public comments, and OCR is still working through them. The timeline has slipped: the 2026 Unified Agenda of Federal Regulatory and Deregulatory Actions lists the rulemaking as a long-term action with final action projected for July 2027, and in December 2025 more than 100 provider organizations, led by the College of Healthcare Information Management Executives (CHIME), urged HHS to rescind the proposal.

What that means practically: do not re-architect your program around proposed language that may change or may not finalize. But do not read “it is only proposed” as permission to stand still either, because the foundation is already required today. Keep the two straight:

What the current Security Rule requires now: a risk analysis and ongoing risk management, and reasonable and appropriate administrative, physical, and technical safeguards for ePHI. Several specific controls are addressable rather than flatly mandated — encryption, for example, is an addressable implementation specification you adopt or document an equivalent for based on your risk analysis, and the current rule does not name multi-factor authentication or a fixed annual interval by rule.
What the 2026 proposal would add if finalized: making several of those explicit and mandatory — for example an annual, documented risk analysis, asset and data-flow inventories, and encryption and MFA as required rather than addressable. These are proposed changes, not present obligations.

Every enforcement action on the record — this week’s Right of Access settlement included — rests on requirements that exist now. None of it is evidence that the proposal’s new mandates are already in force.

What to do with this week

Pressure-test your Right of Access process — this is the week’s headline. Know exactly who handles a patient’s request for their records, in what format, and on what clock, and confirm you have a written right-of-access policy at all. OCR’s Right of Access Initiative has now reached fifty-six enforcement actions, and Shen Smiles is the latest. If a records request came in today, could you show who owns it and when it is due?
Confirm your Security Risk Analysis is current, enterprise-wide, and documented. Not a checklist someone completed once — an analysis that names where ePHI lives across every location and system, rates the risks, and ties to a remediation plan you are actually working. This is the artifact OCR asks for first in the security cases, and the one the high-dollar 2026 resolutions turn on.
Audit access and offboarding. Make sure departing workforce members lose ePHI access on their last day, that records cannot simply walk out with someone, and that every system with ePHI attributes actions to a named individual. The failure in this week’s case started with records that left the practice with a departing worker.

Medcurity’s Security Risk Analysis is built for the artifact OCR asks for first in its security cases — a guided, defensible, multi-site risk analysis with expert review and a tracked remediation plan, mapped to recognized NIST guidance. A risk analysis is not a substitute for the written policies and records-request procedures a Right of Access case turns on, but the same disciplined review is often where an organization first notices those gaps. If this week is a reminder to get the fundamentals in order, that is where to start.

This digest is compiled from public HHS OCR newsroom and press-room postings, the OCR Resolution Agreements list, the HHS breach reporting portal (which could not be queried for this window), state attorney-general announcements, and HIPAA compliance press for the week ending October 9, 2026. The $140,000 Shen Smiles figure is an OCR resolution amount announced October 8, 2026 (the resolution agreement was signed in mid-August 2026 — the dates are distinct); it is separate from the $700,000 Ambry Genetics (September 17) and the $2.3 million multistate LabCorp (September 24) actions, which are prior and are not new this week, and the three are never summed. Where an individual breach count could not be independently confirmed, it is described qualitatively rather than stated as a figure; aggregate breach figures are third-party compilations, not OCR-published statistics, and are reported on a lag. The 2026 HIPAA Security Rule is a proposed rule and is not current law.