Patient records, informed consent, confidentiality, and HIPAA-adjacent obligations
This domain tests the documentation and privacy rules that surround treatment: what goes in the record, how long it stays, when it can be released, and how consent is proved.
Record content and retention
A dental record should identify the patient, date of service, diagnosis, treatment rendered, medications, radiographs, consent discussions, and unusual events. Kentucky Board rules require retention for at least seven years after the last treatment; for minors, retain until the patient reaches majority plus the applicable period. Electronic records must be backed up and protected.
Informed consent
Kentucky uses a reasonable-patient standard under KRS 304.40-320: the patient must be informed of the nature of the procedure, material risks, benefits, and reasonable alternatives, including no treatment. Written consent is strong evidence but not the only way to consent. Emergency exceptions and therapeutic privilege are narrow.
Confidentiality and HIPAA
Dentists are covered entities under HIPAA and must follow the Privacy and Security Rules. Kentucky law can be stricter, especially for HIV-related information under KRS 214.420. Release generally requires a valid authorization unless the release is for treatment, payment, operations, or a legal exception. Minimum necessary applies. Minors’ records require attention to consent and access rules.
Worked example
A patient asks for a copy of records and says she cannot pay her balance. Reasoning: the access right is separate from billing. The office should follow its HIPAA access procedure, provide the record in the requested format within the required timeframe, and charge only a permitted reasonable cost-based fee. Withholding the record as leverage for payment is risky and generally improper.
Traps that cost marks
- Confusing “written consent” with the entire legal test for informed consent.
- Releasing records on a phone request without verifying identity or authorization.
- Applying HIPAA but ignoring stricter Kentucky HIV confidentiality.
- Destroying records too early.