Patient Records, Confidentiality, and Privacy
Records questions combine state record-retention law, HIPAA, and professional ethics. The exam tests ownership, access, retention, minimum-necessary disclosure, authorization, breach notification, and release under subpoena.
Record rules
- The dentist or practice owns the physical or electronic record; the patient has a right to access and copy it.
- Retention periods vary by state and are often longer for minors, running past the age of majority.
- Records must be accurate, timely, legible, and authenticated; late entries should be labeled as such.
- Patients may request amendments; the practice may deny with a written explanation and permit a statement of disagreement.
Privacy and disclosure
HIPAA permits disclosures for treatment, payment, and health care operations without authorization. Other disclosures need a valid authorization unless a legal exception applies, such as required reporting, subpoena with proper order, or serious threat to health or safety. Apply the minimum-necessary standard.
Worked example
A patient’s spouse calls and asks whether the patient attended an appointment and what was found. The spouse is not on an authorization and the patient has not agreed to disclosure. The front desk should not confirm the appointment or the diagnosis. Scheduling information can itself be protected health information. Verify identity, check for authorization, and offer to take a message.
Traps
- Saying the record belongs to the patient; ownership and access are different.
- Releasing records on a verbal request from an employer or insurer.
- Assuming HIPAA preempts stricter state confidentiality law.
- Confusing the six-year HIPAA retention period with state record-retention rules.
- Missing that social media posts can be disclosures even without a name.
Exam focus
Identify the requester, the legal basis, the minimum data needed, and the documentation.