A Solo Practice Paid $70,000 Because a Records Request Sat for Three Years
HHS fined a one-dentist Maryland office $70,000 for answering a patient records request three years late. No breach required. The front-desk process that prevents it.
A solo dentist in Maryland paid the federal government $70,000 because a patient asked for their records in 2019 and didn't get them until May 2022. No hacker. No stolen laptop. No ransomware note. Just a request that sat in a pile for roughly three years while the practice kept seeing patients like nothing was wrong. HHS Office for Civil Rights imposed that civil monetary penalty on Gums Dental Care, and it was the 50th enforcement action under the agency's Right of Access initiative since the initiative launched in the fall of 2019.
Most owners budget for HIPAA as if the risk is a cyberattack. It isn't. The risk is a front desk that doesn't have a written process for the least interesting task in your building, and a federal agency that has spent six years proving it will fine a one-dentist office over exactly that.
The Penalty Wasn't for a Breach. It Was for Ignoring Mail.
This is the part owners keep missing. Right of Access cases don't require anyone to lose data. They require a patient to ask for their chart and not get it in time. That's it. The Gums Dental Care case ran from a 2019 request to a May 2022 delivery, which is not a gray area. Somebody complained, OCR opened a file, and the practice ended up with a number attached to its name in a federal press release.
Now think about how a records request actually moves through your office. A patient calls on a Tuesday. Whoever picks up writes it on a sticky note or promises to "get to it." That person goes to lunch, works a half day Thursday, or leaves the practice in March. There is no queue, no timestamp, no owner, and no report anyone runs on Monday morning. The request doesn't get denied. It just evaporates. Three years later, it's a federal file.
The enforcement pattern isn't limited to one office either. The running database of OCR settlements and civil monetary penalties from 2008 through 2026 includes solo practitioners like Dr. Robert Glaser alongside large health systems. The idea that OCR only goes after hospitals with 4,000 employees is a story small practices tell themselves. The record says otherwise.
