Records, an HR Fax, and an Instagram Reel
You are Sam, RDH, in a four-dentist practice in Grand Rapids. In a single week: (1) Marisol, 34, asks for a copy of her complete chart. The office manager says the practice “doesn't release records until the $85 balance is paid” and quotes $1.25 per page plus a $30 “records handling fee.” (2) Marisol's employer, an auto supplier, faxes a request for “all treatment records, including any HIV-related information,” on company letterhead with no patient signature, saying it is needed for a leave-of-absence claim. (3) Sam posts an Instagram reel showing a patient's lower anteriors with a distinctive tattoo visible on the chin, captioned “when the calculus wins 🦷 #dentalhygiene #grandrapids.” No name is used. (4) The practice's written policy says records are shredded three years after the last visit.
1. How should the practice respond to Marisol's records request - the balance, the per-page charge, and the handling fee?
Read the worked answer
The patient, or her authorized representative, has a right of access to her record, and the practice's leverage - “pay first” - is not permitted.
- The balance. An unpaid $85 is a collections matter. Conditioning records access on payment is an impermissible ground for denial and a straightforward Board complaint; it also exposes the practice under HIPAA's right-of-access provisions, which carry their own enforcement mechanism.
- The fee. Michigan's medical records statute permits a cost-based fee within a statutory cap; the exact figure should be confirmed against the current statute before anything is quoted. A flat $30 “handling fee” plus $1.25 per page needs to be justified against that cap and against actual copying cost, not set as a deterrent.
- The scope. Provide the complete record - chart notes, radiographs, lab slips, correspondence - in the format requested. Do not edit, summarize, or omit entries that are unflattering. Later alteration of a record is a far more serious violation than whatever the entry said.
Process: route the request to the designated records contact, verify identity and the signed authorization, itemize the fee, and log the date and exactly what was sent. If the manager refuses, put the objection in writing to the owner-dentist - the practice, not the hygienist, bears the liability, but the hygienist's documentation is what proves she raised it.
2. How should the practice handle the employer's fax requesting “all treatment records, including any HIV-related information”?
Read the worked answer
Do not disclose anything on the basis of that fax. There are two independent problems.
No authorization at all. HIPAA requires a valid, specific, patient-signed authorization identifying the information, the recipient, the purpose, and the expiration. A letter on company letterhead requesting “all treatment records” for a leave claim is not an authorization; it is a request from a third party with no legal authority to receive the record.
Heightened protection for HIV information. Michigan's HIV confidentiality statute gives HIV-related information specific statutory protection: disclosure requires a separate written authorization that meets the statutory form, and unauthorized disclosure carries civil and even criminal exposure. A general employment form will not satisfy it.
Even with a valid authorization, release only the minimum necessary. A leave-of-absence claim typically needs dates of treatment or a statement about work capacity - not a treatment narrative, and certainly not HIV status.
Correct response: a written refusal to the employer citing the absence of authorization, plus a call to Marisol explaining what a valid authorization would need to contain if she wants the practice to respond. If she does authorize, log exactly what was disclosed, to whom, and on what authority - that log is the practice's defense.
3. Analyze the Instagram reel and the three-year retention policy. What has to change, and what should Sam do about each?
Read the worked answer
The reel is a breach. Even cropped and unnamed, an intraoral photo with a distinctive tattoo is potentially identifiable - the tattoo is precisely the kind of quasi-identifier a privacy analysis exists to catch. Posting it is a use or disclosure for which HIPAA requires a written patient authorization, and Michigan's unprofessional-conduct provisions reach the same conduct. Mocking content adds an independent professionalism problem even where identifiability is debatable.
Steps: remove the post immediately; notify the privacy officer; document what was posted, when, to what audience, and when it was removed; run it through the practice's HIPAA incident risk assessment; and expect that the Board will view patient-mocking content as unprofessional conduct in its own right. Sam should also expect that a coworker or patient may report it, and that “no name was used” is not a defense she should rely on.
Retention: a three-year shred policy is well short of Michigan's expectation. The commonly applied minimum for dental records is seven years from the last date of service, and longer for minors in many practices, plus any period required by a payer or a litigation hold. Recommend in writing that the policy be revised, that destruction be logged, that destruction be suspended whenever a records request, complaint, or legal hold is pending, and that destruction render the record unreadable. A practice that shreds at three years has no defense at all if a patient brings a claim in year five.