She Quit. Nobody Turned Off Her Access. It Cost the Practice $140,000.

October 17, 2026 · 3 min read

Listen
0:00
Abstract illustration of a patient file dissolving into data ribbons slipping through a closing gate of blue light

A solo dental practice in Pennsylvania just paid $140,000, and the most expensive line item was an unchecked box on an offboarding checklist.

The practice was Shen Smiles, a single location in Drums, Pennsylvania. On October 8, the HHS Office for Civil Rights announced a $140,000 civil money penalty. The case started when a patient asked for her records and didn’t get them — but the part that should worry every practice owner is what investigators found next.

A former employee had taken patient records with her when she left. Nobody had turned off her access. There were no real HIPAA policies, no formal staff training, and patient records were being transported to the dentist’s home. The practice’s defense was, essentially: it was the ex-employee’s fault.

OCR’s answer, in effect: if someone who no longer works for you can walk off with patient data, your systems failed.

This is not a compliance story. It is an IT story. Every item on the findings list maps to a basic systems control that most small practices never got around to setting up.

The systems failures, translated

  1. Ex-employee kept her access. Nobody deprovisioned her accounts when she left. This is the one that cost them.
  2. No real access controls. When everyone can reach everything, “who took the records?” becomes unanswerable.
  3. No audit trail anyone looked at. Most EMRs log access. Almost nobody in a small practice ever reviews those logs.
  4. Patient data on personal turf. Records transported to the dentist’s home, which means patient data lived on unmanaged devices outside every safeguard the practice had.
  5. No policies, no training. The human layer. Nobody had been told what the rules were, so nobody followed them.

Here is the uncomfortable part: most small practices run exactly like this. One shared front-desk login. Someone quits and their account stays active “just in case.” Nobody reviews who has access to what. It works fine until the day it doesn’t — and then it is a federal investigation, not an IT ticket.

What to do Monday morning

  1. Kill access the day someone leaves. Not the end of the week. The day. EMR, email, VPN, shared drives — one checklist, same day, every time.
  2. No shared logins. Ever. “FrontDesk1” with the password on a sticky note means your audit log is fiction.
  3. Turn on audit logging in your EMR and actually review it quarterly. The logs are useless if nobody reads them.
  4. Patient data stays on managed devices. Not personal phones, not home computers, not the dentist’s laptop.
  5. Quarterly access review. Pull the user list from every system and ask one question: does this person still work here?

Shen Smiles wasn’t hacked. Nobody targeted them. They were investigated because one patient complained, and the investigation found systems running on habit instead of process.

$140,000 for an offboarding checklist. The IT was cheaper.