Patient Records, Informed Consent, Confidentiality, and HIPAA
This section covers patient records, consent, and confidentiality; the exam tests record retention, informed consent, and HIPAA exceptions.
Record content and retention
Patient records must be accurate, legible, dated, and authenticated. They include medical history, assessments, radiographs, treatment, informed consent, medications, referrals, and communications. Kentucky Board rules require retention for a defined period; a practical baseline is at least five years after the last treatment, with longer retention for minors and when litigation or Board complaints are pending. Never alter a record after a complaint; add a dated addendum instead.
Informed consent
Consent must be obtained before treatment, including hygiene services and expanded functions. The discussion should cover diagnosis, proposed treatment, risks, benefits, alternatives including no treatment, and the opportunity for questions. Document who consented and when. For minors, the parent or legal guardian consents.
Confidentiality and HIPAA
HIPAA permits disclosures for treatment, payment, and operations, and requires minimum necessary use and breach notification. Kentucky law adds confidentiality duties and mandatory reporting exceptions, such as child abuse. Release of records generally requires a valid authorization unless a legal exception applies.
Worked example
A divorced parent asks for the child's records. The office should verify who has legal authority to consent and access under the custody order; if the requesting parent is authorized, provide the records and document the request. Do not refuse solely because the parents are divorced, and do not release to the other parent without authority.
Traps
Backdating or 'fixing' a note. Assuming HIPAA bars all disclosures, including Board investigations. Releasing records without a valid authorization. Failing to document informed consent for local anesthesia.