OCR HIPAA Enforcement in 2024: What Dental Practices Need to Understand

On October 17, 2024, the HHS Office for Civil Rights announced a $70,000 civil monetary penalty against Gums Dental Care, a solo dental practice in Maryland. The violation was not a data breach. No hacker was involved. No patient records were stolen. The practice simply failed to provide a patient with timely access to her and her children's records.

That was OCR's 50th Right of Access enforcement action since it began the initiative in 2019. It will not be the last.

How the Gums Dental Care Case Unfolded

The enforcement action began with a patient complaint — the most common trigger for OCR investigations of small practices. The patient alleged that the practice had not provided her with access to her and her children's records. OCR sent a letter notifying the practice of its obligations under the HIPAA Privacy Rule's Right of Access provisions. A second complaint from the same patient prompted OCR to open a formal investigation, which concluded with the $70,000 penalty.

The mechanics of the Right of Access rule are straightforward. Patients and their personal representatives have the right to inspect and obtain copies of their protected health information within 30 days of making a request. The deadline can be extended once by another 30 days, and practices may charge a reasonable cost-based fee. Failure to comply — even in response to a single patient's request — is a HIPAA violation. OCR has made clear it will enforce it.

The Broader 2024 Enforcement Picture

The Gums Dental Care penalty was one of nine financial penalties OCR imposed in 2024 in response to complaints — as opposed to penalties arising from data breach investigations. In total, [OCR imposed 22 financial penalties in calendar year 2024](https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html), collecting $9.94 million in settlements and civil monetary penalties.

OCR received 30,256 new complaints in 2024. Of the 1,370 complaint investigations completed that year, 48 percent required the regulated entity to take corrective action. The most common complaint categories were impermissible uses and disclosures (660 complaints), Right of Access violations (541 complaints), and missing general safeguards (481 complaints).

For dental practices, the Right of Access category is the most direct risk. It requires no sophisticated attacker, no data breach, and no large-scale exposure of patient records. It requires only a patient who asked for their records and didn't receive them within the required window.

What Triggers an OCR Investigation

Small practices are often surprised to learn how OCR investigations begin. The agency does not conduct random audits of solo dental offices. The most common trigger is a patient complaint — a single individual filing a report with OCR alleging that their rights under HIPAA were violated. OCR is required to investigate complaints that appear to describe a potential violation.

The Gums Dental Care case illustrates the pattern: one complaint, a letter from OCR, a second complaint, an investigation, a penalty. The practice had multiple opportunities to resolve the situation before it reached the penalty stage. Practices that respond promptly to records requests and to OCR correspondence generally avoid financial penalties even when they have made a compliance error. Practices that do not respond — or that continue the non-compliant behavior after being notified — face significantly higher risk.

Data breach investigations are the other major trigger. In 2024, OCR opened investigations into all 663 large data breaches (affecting 500 or more individuals) reported that year. Of those, 13 resulted in financial penalties. The most common Security Rule deficiencies found during breach investigations were inadequate risk analysis, weak authentication practices (including default passwords and single-factor remote access), and insufficient access controls.

The Dental Practice Risk Profile

The enforcement record from 2022 through 2024 tells a consistent story about dental practices. In 2022, eight dental practices settled with HHS for a combined $305,500, primarily over right-of-access violations. The pattern has continued. Dental practices are covered entities under HIPAA, subject to the same rules as hospitals and health systems, but they typically have fewer compliance resources and less institutional awareness of their obligations.

The website is one area where this gap is particularly visible. Most dental websites were built by agencies with no HIPAA expertise. Forms submit to email services without BAAs. Tracking pixels run on appointment request pages. Patient portal login pages have third-party analytics scripts. None of these configurations were reviewed by anyone with HIPAA knowledge before the site went live.

What a Compliant Practice Looks Like

Compliance is not a single checklist item — it is an ongoing operational posture. The practices that avoid enforcement actions share a few characteristics: they respond to patient records requests promptly and document those responses; they have signed BAAs with every vendor that touches PHI; they conduct periodic risk analyses and document the results; and they train staff on HIPAA obligations regularly.

For the website specifically, compliance means HIPAA-compliant hosting with a signed BAA, encrypted form submissions, a tracking pixel audit, and documented review of any third-party integrations. It also means knowing what to do when a patient makes a records request — and doing it within the required window.

If you want to understand what HIPAA compliance looks like for a dental website specifically, our [compliance overview](/compliance) covers the key areas: hosting, forms, tracking, BAAs, and what we build into every site we deliver. If your current site hasn't been reviewed for HIPAA compliance, that review is worth scheduling before a patient complaint makes it a more expensive conversation.