Documentation, Recordkeeping, and Confidentiality
Record content and retention
A patient record must be accurate, timely, legible, and complete. It should show the history, examination findings, diagnoses, treatment, prescriptions, informed consent, referrals, and communications. The board's retention rule sets the minimum period; do not destroy records while an investigation, complaint, or litigation is pending. Electronic records need access controls, audit trails, and backups.
Confidentiality
Patient information is protected by North Dakota law and federal HIPAA rules. Disclosure is permitted for treatment, payment, and health care operations, and for specific legal exceptions such as abuse reporting, public health duties, court orders, and patient authorization. A subpoena is not automatically a valid authorization; it must be handled under the applicable legal process.
Worked example
An employer asks for a patient's entire eye record to evaluate a workers' compensation claim. The optometrist should not release the full record on the employer's oral request. The office should obtain a valid authorization or follow the legal process for a workers' compensation release and disclose only what is authorized. The reasoning: confidentiality follows the patient, not the payer or employer.
Traps that cost marks
Do not say HIPAA prohibits all disclosures; it permits specific ones. Do not confuse record ownership with access rights: the practice generally owns the record, but the patient has access rights. Do not release information because a request looks official. Do not document late or alter a record after a complaint without proper correction procedures.