Associate Takes Records and Posts Before-and-After Photos
Dr. Alvarez sells her Chicago practice to Dr. Kim. Dr. Lee, an associate who leaves the week after the sale, copies 300 patient charts, including radiographs and contact information, onto a personal hard drive. He also posts three before-and-after crown photos on his new Instagram account. The photos show patients’ smiles but no names. One patient recognizes herself and calls Dr. Kim’s office, demanding to know who authorized the post and where her records went. Dr. Lee says he “needs the records for his new office” and that the photos are his own work. The purchase agreement is silent on records and photos. Dr. Kim asks whether the patients must be notified, whether Dr. Lee can keep the copies, and what must happen to the Instagram post.
1. Who owns the dental records, and may Dr. Lee take copies to his new office?
Read the worked answer
Dental records are the property of the practice or dentist that created and maintained them, not of an associate who happened to treat the patient. Patients have a right to copies, but that does not give Dr. Lee the right to remove the practice’s records. Because the purchase agreement is silent, Dr. Kim should establish ownership through the sale documents and applicable law. Dr. Lee may keep records only with proper authorization or a lawful transfer agreement that protects patients and gives required notice. Taking 300 charts, radiographs, and contact information without authorization is a confidentiality and records-control problem; Dr. Lee should return or destroy the copies and document what was done.
2. What authorization is needed for the Instagram before-and-after photos, and what are the risks of posting them?
Read the worked answer
Before-and-after photos are patient information when the patient is identifiable, even without a name. A recognizable smile can be enough. Dr. Lee needs a valid written authorization that complies with HIPAA and Illinois law before using the images for marketing. “It is my own work” is not a defense; the patient’s identity and privacy are the issue. Posting without authorization can support discipline for revealing patient information, violate privacy law, and create advertising concerns if the images are misleading. The post should come down promptly, and the office should preserve evidence of when it was posted and removed.
3. What should Dr. Kim do about patient notification and record retention?
Read the worked answer
Dr. Kim should investigate the scope of the record removal, secure the practice’s remaining records, and determine whether a privacy breach occurred. If the copied records include protected health information, a breach assessment and notification may be required under HIPAA and Illinois law. Patients who ask should receive copies of their records as permitted, and the practice should not withhold them over an unpaid balance or the dispute with Dr. Lee. Dr. Kim should document the investigation, notify affected patients if required, and consider a complaint to IDFPR about Dr. Lee’s conduct. The office should also adopt a written records-transfer and marketing-authorization policy so the same problem does not recur.