Records Request, an Employer Fax, and a Backdated Note
A patient, Ms. Rivera, had a crown seated 14 months ago. She now owes $640 and has asked three times for a copy of her chart and radiographs to take to a new dentist. The office manager says the practice will not release anything until the balance is paid and quotes a $95 "records fee" plus $25 per radiograph. Separately, Ms. Rivera's employer faxes a signed request for "all records relating to her work excuse" after she missed three days with migraine. The front desk sends the entire chart, including notes about a prior opioid prescription and a positive screen for cannabis. The associate who saw Ms. Rivera for a postoperative complication last month also adds a late entry to the chart today, backdating it to the date of the visit, because he forgot to note the complication.
1. May the practice withhold the records and radiographs until the $640 balance is paid? Analyze the fee and timeline.
Read the worked answer
Probably not. HIPAA's right of access requires a covered dental practice to provide the patient with a copy of her records and radiographs within 30 days of a proper request, with one possible 30-day extension if the practice gives the patient written notice of the reason. The practice may charge a reasonable, cost-based fee covering labor, supplies, and postage, but it should be able to explain how the fee was calculated. A flat $95 plus $25 per radiograph may exceed actual cost and should be reviewed against applicable state and federal limits.
Withholding records solely because a bill is unpaid is generally not an acceptable basis for denying the right of access. The practice should provide the records and pursue the $640 separately through billing or collection. The office should also respond in the format the patient requested, document the request and response dates, and avoid delaying while the balance dispute continues.
2. Did the front desk's response to the employer comply with HIPAA? What should have been sent?
Read the worked answer
No. A signed authorization from the patient is generally required before disclosing protected health information to an employer. Even with an authorization, HIPAA's minimum necessary standard limits the disclosure to what the employer needs for the stated purpose. The employer asked about a work excuse for three missed days with migraine; it did not need the patient's opioid history, cannabis screen, crown records, or the entire chart.
The office should have sent only the work-excuse portion or a short letter confirming the dates the patient was seen and the recommended absence, after confirming the authorization was valid and covered that disclosure. Sending the full chart was over-disclosure and may be a reportable breach. The practice should notify its privacy officer, assess whether notification to the patient or HHS is required, and retrain staff. Substance-use information deserves extra caution because it can be stigmatizing and may be subject to additional legal protection.
3. How should the associate correct the missing postoperative note? What are the consequences of backdating?
Read the worked answer
The associate should not backdate. A late entry is permissible if it is clearly identified as a late entry, dated with the actual date of entry, and explains why it is being added. For example: "Addendum added [today's date]: I am adding this note to document the postoperative complication discussed with the patient on [visit date]; the original note was inadvertently incomplete." The original entry must remain unchanged.
Backdating a note is falsification of a patient record. It undermines the credibility of the entire chart, can mislead a subsequent treating dentist, and may constitute unprofessional conduct subject to DPH discipline. If the record has already been altered or backdated, the associate should not try to hide it; a corrected addendum and legal advice are appropriate. The practice should also preserve the audit trail and any metadata if a complaint or lawsuit is anticipated.