Misconceptions About Compliance
Small healthcare providers often think they're too small to need formal HIPAA compliance programs. You might hear, "We're just a two-dentist practice. Everyone knows to protect patient information. We don't need written policies gathering dust in a binder."
This mindset relies on three flawed assumptions: that common sense replaces documented procedures, that the Office for Civil Rights (OCR) targets only large health systems, and that formal policies create unnecessary bureaucracy. These arguments, though common, are dangerously incorrect.
The Reality of Enforcement
The "too small to need policies" defense fails when OCR investigates. You can't prove compliance with undocumented requirements.
Consider the case of Shen Smiles, a Pennsylvania dental practice. When OCR requested documentation of policies for patient access requests, the practice owner admitted they didn't exist, claiming they were stolen. When asked for administrative safeguard documentation and evidence of workforce training, the response was "None."
OCR found the practice non-compliant with 45 C.F.R. § 164.530(i)(1), which requires policies and procedures, and 45 C.F.R. § 164.530(c)(2)(i), which mandates administrative safeguards. The practice paid $140,000 to resolve the issue, marking the 56th enforcement action under OCR's Right of Access initiative.
OCR didn't accept "we're a small practice" as a defense. Regulations don't exempt small practices. If you're a covered entity, you must implement policies and procedures, regardless of size.
The investigation found patient records stored inappropriately, and staff often couldn't locate them. Employees hadn't received formal HIPAA training. This wasn't about cyberattacks; it was about missing basic administrative controls.
The Evidence for Compliance
The HIPAA Privacy Rule at 45 C.F.R. § 164.530(i) requires covered entities to implement policies and procedures, regardless of size. The Security Rule at 45 C.F.R. § 164.316(a) and (b)(1) mandates written documentation of these policies.
OCR's enforcement shows they investigate small providers. In 2026, this was OCR's 11th HIPAA case resolved with a financial penalty. OCR reduced Shen Smiles' penalty by 90% due to its small size, but the penalty still reached $140,000.
Even with a reduction, penalties can be substantial. Your size might reduce the penalty, but it doesn't eliminate the violation or investigation.
Steps to Take
Start with the administrative safeguards that Shen Smiles lacked. You need documented policies covering:
Workforce training. 45 C.F.R. § 164.530(b) requires training for all workforce members on your policies. Document who received training, when, and on what topics. Keep attendance records.
Access controls for physical records. Define where paper records are stored, who can access them, and how they're secured. "Locked file cabinets in the records room, accessible only to clinical staff" is a policy.
Patient access procedures. Document how you receive record requests, your response timeline (generally 30 days), identity verification, fee structure, and request tracking.
Sanctions. 45 C.F.R. § 164.530(e) requires sanctions for policy violations. Define "appropriate" for your practice and document when sanctions are applied.
Breach response. Even without a breach, you need written procedures for assessing incidents, determining reportability under 45 C.F.R. §§ 164.404-408, and executing notifications.
Your policies don't need to be extensive. A small practice can document core HIPAA requirements in 15-20 pages. What matters is that they exist, are accurate, and are followed.
Balancing Resources and Compliance
Small practices face resource constraints. You don't have a compliance department or a full-time privacy official. Your office manager handles HIPAA alongside other duties.
Focus on controls that directly reduce risk. Prioritize administrative safeguards over elaborate documentation. Train staff on practical scenarios they'll encounter. Implement simple, repeatable processes.
Your risk analysis can be a structured spreadsheet. Your training can be a recorded session delivered annually. Your policies can use plain language and practice-specific examples.
But "simple" isn't "optional." You still need policies, training records, and to demonstrate required safeguards.
The $140,000 penalty Shen Smiles paid could have funded years of compliance infrastructure: policy templates, training, secure file cabinets, and documented procedures. The practice owner thought they were too small for formal compliance. OCR disagreed, and it was costly.
Your practice size doesn't determine your regulatory obligations. It only determines how you scale your compliance program to meet them.
