Patient record access is a records continuity workflow, not merely an electronic health record (EHR) login. Our recommendation for a Sarasota practice: make sure an authorized backup person can locate the requested records, track the deadline, and complete the handoff when the usual owner is absent.
What the October settlement actually says
On October 8, 2026, HHS announced a $140,000 settlement with Shen Smiles, a Pennsylvania dental practice, resolving an investigation into alleged failure to provide timely access to a patient's protected health information (PHI).[1] The practice asserted that a workforce member stole the records; that was its explanation, not independent proof of theft.[1] HHS reported missing policies and procedures, including right-of-access procedures, and insufficient safeguards for PHI.[1]
This is a Pennsylvania enforcement matter, not a Sarasota incident or evidence of a ransomware or cloud-service failure.[1] For local practice managers, our takeaway is practical: write the retrieval process so it does not depend on one employee, one account, or one system staying available.
1. Map the records, not just the patient portal
The HIPAA Privacy Rule generally gives individuals access to PHI in designated record sets maintained by or for a covered entity, with limited exceptions.[5] That includes electronic and paper information, not just the EHR: billing and payment records and other records used to make decisions about individuals can also fall within scope.[5]
Ask the privacy lead to define your practice's record sets, then make a working map: system or cabinet, responsible person, vendor contact, retrieval method, and any dependencies. Include archived records and paper files in the review. HHS says age or storage location alone does not remove the access right.[5] Use our HIPAA compliance guide for the broader safeguard program; this map serves a specific patient-request workflow.
2. Log the request and name an owner plus backup
We recommend one controlled request log rather than separate reminders in individual inboxes. Record receipt date, requested scope, assigned owner and backup, due date, retrieval status, and completion evidence. Follow the practice's approved identity-verification and delivery procedures. Keep patient details out of general IT tickets and public contact forms.
Give front-desk staff a clear route to the request owner. Have the backup demonstrate that they can use the log and contact each record custodian under their own authorized account. Do not solve an absence by sharing the departing employee's password. Connect this handoff to your medical IT program, with administrative and technical responsibilities written separately.
3. Escalate before the deadline becomes a surprise
Under HHS guidance, a covered entity must act on an access request within 30 calendar days after receipt.[5] If it cannot act within that period, it may take one extension of up to 30 calendar days, provided it gives the individual a written reason for the delay and a completion date within the initial 30-day period.[5] This is not a routine 60-day window; HHS encourages access much sooner.[5]
Our recommendation is to assign internal checkpoints well before the outer limit. Escalate missing records or a stalled vendor request to the privacy lead immediately, not on the last day. Have that lead or counsel review whether other applicable law requires a faster response. Record who will communicate with the patient and when; do not let an open technical ticket become the whole response plan.
4. Make workforce departures safe for records continuity
For electronic protected health information (ePHI), the current Security Rule requires appropriate workforce authorization and role-based access policies, alongside mechanisms to record and examine system activity.[3] The Security Rule addresses electronic information; the Privacy Rule access right also covers paper records.[3][5]
Our recommended departure checklist pairs access removal with preservation. Identify pending requests, transfer assigned work to an authorized person, recover practice-controlled devices and keys, and have IT revoke access at the approved time. Confirm that records and relevant activity logs remain available before deleting accounts or storage. Review physical file access too. If records appear missing, preserve the facts and involve the privacy lead and qualified responders rather than asking staff to reconstruct events in an unrestricted group chat.
5. Ask vendors to demonstrate usable recovery and export
HHS cloud guidance requires a business associate agreement when a covered entity uses a cloud service provider to handle ePHI on its behalf, including encrypted storage the provider cannot view.[4] A service-level agreement can address availability, backups and recovery, data return after termination, and security responsibilities; the practice still has its own risk-analysis obligations.[4]
Ask who can request an export, what it contains, how long it takes, and how an authorized replacement custodian will read it. Our implementation recommendation is to test a representative export in an approved, protected environment and record missing attachments or unreadable formats. Do not download an entire database to a personal laptop or unprotected USB drive to prove the point.
The current Security Rule's contingency provisions include plans to back up ePHI, restore lost data, and continue critical processes while protecting ePHI in emergency mode.[3] We recommend a controlled restore exercise that checks the actual record-retrieval task, not just a successful backup notification. Our backup and disaster recovery services address that technical planning. If ransomware is suspected, use the separate medical-practice first-hour response plan; do not start restoring into a potentially compromised environment on your own.
A fictional Sarasota-to-Bradenton handoff
Consider a fictional practice with a Sarasota office and a Bradenton billing contractor. A patient requests records spanning current visits and an older paper chart while the usual records coordinator is on leave. The backup owner logs the request, checks the approved record-set map, and assigns retrieval tasks to the office custodian and contractor contact.
For this exercise, have the team locate a blank sample chart and fictional billing entries, verify the approved delivery route, and document what would happen if the contractor did not respond. No real patient data is needed. The useful result is a tested handoff, with named owners and unresolved gaps—not a claim that opening the portal completed the request.
Three things you can do this week
- Map one complete request. Follow a fictional request through electronic, paper, archived, and vendor-held records. Assign an owner to every gap.
- Rehearse an absence. Ask the backup owner to find the log, due date, retrieval instructions, and escalation contact without using anyone else's credentials.
- Request recovery evidence. Review one protected export or restore test with IT and the privacy lead. Record its date, scope, result, and next corrective action.
Put the handoff on paper
We review systems and responsibilities through our Free Systems Audit, on-site at your Sarasota or Manatee County business. Visits usually take 45–60 minutes within a 60-minute calendar slot. Every completed audit includes a full, customized Client Threat & Architecture Report with prioritized practical findings.
Gregory Mathews, Systems Architect, Suncoast MIS LLC
Source Notes and Scope
The linked HHS materials support the enforcement facts and federal requirements described above. The log, backup-owner handoff, departure checklist, and test sequence are our implementation recommendations, not a verbatim legal checklist. This is technical education, not legal advice or a HIPAA certification. The practice and its qualified advisors retain responsibility for legal interpretation, exceptions, retention, and applicable deadlines.
Sources
- [1] HHS OCR: Shen Smiles Right-of-Access Settlement, October 8, 2026
- [3] HHS: Summary of the HIPAA Security Rule
- [4] HHS: Guidance on HIPAA and Cloud Computing
- [5] HHS: Right to Access and Research FAQs
Author & technical scope review
Gregory Mathews
Gregory is the Systems Architect and founder of Suncoast MIS, with 15+ years of practical IT and systems architecture experience. He authored this article and reviewed its technical scope. Compliance, legal, and insurance conclusions remain with each organization and its qualified advisors.