Joint Custody, a Subpoena, an Unpaid Balance, and an Instagram Post

Framework. A minor generally cannot consent to dental treatment; consent comes from a parent or legal guardian. With joint legal custody, both parents ordinarily retain the right to make and be informed of health care decisions unless the decree allocates that authority differently.

Application.

• Read the decree first. The office should obtain and file a copy. Joint legal custody usually means either parent may consent, but decrees vary, and some allocate medical decision-making to one parent.
• If either parent may consent, the mother's consent is valid and Dr. Alvarez may proceed. The father's objection does not automatically veto treatment, but it should not be ignored: the office should notify him in writing that treatment is scheduled, invite him to review the plan, and document the exchange.
• If the decree requires joint consent or gives the father decision-making authority, proceed only with both signatures, and pursue court clarification if the parents deadlock.
• Emergency exception. If the tooth becomes painful, infected, or at risk of loss, the dentist may provide urgent stabilizing care and document why delay was unsafe.

Conclusion. Get the decree, document who consented and on what authority, communicate with both parents in writing, and consider whether a crown can wait for clarification. What Dr. Alvarez must not do is treat on the assumption that "the mother has custody" - residential custody and legal custody to consent are different things.

Framework. A dental practice that bills electronically is a HIPAA covered entity, and Kentucky confidentiality law applies in parallel. A subpoena issued by an attorney without a court order is not by itself sufficient authority to disclose protected health information.

Application.

• Check the document. This one was issued by a clerk, not signed by a judge. Under HIPAA, disclosure in response to a subpoena requires either satisfactory assurances that the patient (or the patient's personal representative) has been notified and given an opportunity to object, or a qualified protective order. Absent one of those, the practice must not release the record.
• Who is the representative? With joint legal custody, the father may be a personal representative entitled to the minor's records, which strengthens his position - but the mother's payment history is not the minor's treatment record. Payment and billing information about the mother should be separated and withheld absent her authorization or a court order.
• Do not ignore it. The response should be timely: object in writing, state what is being withheld and on what ground, ask for the required assurances or a court order, and notify the mother so she can seek a protective order if she wishes.

Conclusion. Produce nothing yet. Send a written objection identifying the missing HIPAA predicate, offer to produce the clinical record once assurances are provided, and segregate the mother's financial information. Calendar the response deadline so silence is not treated as a waiver.

Framework. Two separate duties: the patient's right of access to her own record, and the prohibition on disclosing identifiable patient information without authorization.

Application.

• The records request. An unpaid balance is not a lawful ground to deny a patient access to her record. HIPAA gives the patient a right to inspect and obtain a copy of her designated record set, including radiographs, on request; the practice may charge only a reasonable, cost-based fee (and must honor any stricter state limits). The practice may bill separately, pursue the balance, or require payment of the permitted copying fee - but it may not hold the clinical record hostage. A prompt written response avoids a right-of-access complaint.
• The Instagram post. Even without a name, a recognizable close-up of a smile plus a distinctive lip scar, tied to a caption identifying "who came in today," is individually identifiable health information. Posting it is a disclosure for marketing and requires a valid written authorization. The caption also confirms the person was a patient, which converts an artistic photo into a HIPAA problem and a state confidentiality problem simultaneously. It is also arguably an invasion of privacy tort.
• Immediate steps. Take the post down, preserve a screenshot for the file, notify the dentist, and conduct a risk assessment to decide whether breach notification is required. Retrain staff on photography and social media, and add an authorization form if marketing photos will ever be used.

Conclusion. Release the radiographs on request for a permitted fee and collect the balance through ordinary means. Remove the post and treat the disclosure as a reportable incident, because "no name" is not the test - identifiability is.