Medical Records, Privacy, and Documentation
Expect questions on what a chart must contain, when records may be released, and how state and federal privacy rules interact.
What must be in the record
A defensible optometric record shows date and patient identity, chief complaint and history, examination findings including the specific tests relied on, diagnosis or assessment, plan and treatment, prescriptions, counseling given, referrals made and tracked, and who performed each component.
Privacy framework
HIPAA governs use and disclosure for treatment, payment, and operations; anything else needs authorization or a specific exception. Minimum necessary applies to disclosures, not to treatment. Patients have rights to inspect and obtain a copy, to request amendment, and to an accounting of disclosures. Indiana's breach notification statute (IC 24-4.9-3) requires notice to affected individuals and to the Attorney General after a security breach; HIPAA adds its own 60-day outer limit.
Release rules
- To another provider for continuing care: permitted as treatment.
- To an attorney, insurer, or employer: written authorization with the scope stated.
- Prescriptions: released under the separate federal prescription rules, not the medical-record rules.
- Retention: follow the longest applicable requirement; HIPAA sets no retention period. Never destroy records with a pending complaint or claim.
Worked example
A patient with an unpaid balance asks for a copy of her chart. You may not withhold records to collect a bill. You may charge a reasonable, cost-based fee and must respond within 30 days.
Traps
Discussing findings with a spouse on the phone without authorization; sending the entire chart when a specific-date request was made; assuming HIPAA preempts stricter Indiana confidentiality law; backdating a late entry instead of labeling it as an addendum.