Patient and Business Records Management
Patient and business records management covers the life cycle of the dental record: what is entered, who may see it, how it is released, how long it is kept, and how errors are corrected. The exam favors practical privacy and documentation decisions over clinical diagnosis.
Record content and charting
A complete record identifies the patient, contains signed consents, medical history and updates, diagnoses, treatment plans, progress notes, radiographs, medications and allergies, referrals, correspondence, and financial and insurance entries. Each entry is dated, authenticated, objective, and legible. If something was omitted, add a dated addendum; never backdate or overwrite the original.
Privacy and release
HIPAA permits uses and disclosures for treatment, payment, and health care operations without authorization; other disclosures need a valid authorization with purpose, expiration, recipient, and right to revoke. Verify identity and authority, such as parent, guardian, or power of attorney. For a subpoena, follow legal review rather than copying records automatically. The right of access generally requires a response within 30 days, with one possible 30-day extension, in the requested electronic form if readily producible, for a reasonable cost-based fee. Keep an accounting of disclosures for six years and retain HIPAA documentation for six years; state record-retention rules may be longer, especially for minors.
Storage and destruction
Back up electronic records, restrict access by role, log audits, and destroy paper and electronic media securely when retention ends. Retention for adults is often measured from the last treatment date, while minors are held until majority plus the state limitations period; confirm the state rule.
Worked example
A patient emails asking for the complete record and radiographs in electronic form. The administrator verifies identity, confirms the patient is an adult with no representative, logs the request, and supplies the records within 30 days in a readable electronic format. A reasonable cost-based fee is charged. The reasoning: access is a patient right; authorization is not required for the patient’s own request; the format should match the request when readily producible; and the release is documented.
Traps that cost marks
Releasing records to a spouse or employer without authorization; altering an original note to fix an error; charging excessive fees; destroying records at a fixed seven years when state or minor rules require longer; discussing records in public areas; and ignoring a request because it arrived by email.