Patient Records, Informed Consent, Confidentiality, and HIPAA
Record content and retention
A patient record must document history, examination, diagnosis, treatment plan, progress notes, radiographs, consent, medications, and communications. Massachusetts Board rules require retention for a defined period; a practical benchmark is seven years from the last treatment for adults, and for minors until age 21 or seven years, whichever is longer. Keep records secure, legible, and complete.
Consent and confidentiality
Informed consent requires diagnosis, nature of treatment, risks, benefits, alternatives, and the consequences of refusal. HIPAA permits disclosures for treatment, payment, and operations, but otherwise requires authorization or a legal exception. Use the minimum necessary. Patients have a right to access their records within 30 days, with limited fee rules. A parent or guardian generally acts for a minor, subject to state law on confidential services.
Worked example
A patient requests a copy of records and owes a balance. Reasoning: HIPAA access rights are not conditioned on payment; provide the copy within the required time and charge only permitted fees. Do not release to an employer or school without a valid authorization.
Traps
Do not alter records after a complaint; late entries should be clearly dated and identified. Do not discuss patients in public or on social media. Do not assume email or text is automatically secure.