A patient calls and wants her records. She is switching to a practice across town, she is a little annoyed, and she wants everything. What happens next in your office?
In a lot of practices, what happens next is a series of small unforced errors. Somebody says she has to come in and sign a form. Somebody else says the doctor has to review it first. A week goes by. Then somebody mentions the outstanding balance, and suggests the records can be released once that is settled. Every one of those moves feels reasonable from behind the counter, and collectively they are how a routine request becomes a complaint.
This lesson is the patient facing half of the Privacy Rule: what people can ask for, what you owe them, when you need written permission and when you do not, and how to handle the counter conversation when the person asking is not the patient. Get these wrong and you generate the specific kind of complaint that regulators find easy to act on, because the facts are simple and documented.
The right of access carries specific requirements about timing, permitted fees, formats and denials, and those requirements have been the subject of repeated guidance and revision. State law adds its own layer on records, fees, minors, mental health information, substance use records and more, it is often stricter than the federal floor, and it varies substantially by state. This lesson describes the shape of each obligation only. Confirm every deadline, fee limit and retention period against the current regulation and your state's rules through our state resource pages, and get your own release and authorisation forms reviewed by a healthcare attorney. Nothing here is legal advice.
What you will learn
- What the right of access actually obliges a dental practice to do, and the three mistakes offices make most.
- What the Notice of Privacy Practices is for and where the acknowledgement fits.
- The difference between a permitted disclosure and one that needs written authorisation.
- How amendments, restriction requests, confidential communications and accounting of disclosures work in shape.
- How to handle the spouse or parent at the front desk without either violating privacy or being rude about it.
The Right of Access, and the Three Classic Mistakes
Individuals have a right of access to their own protected health information held in what the rules call a designated record set. In a dental practice that generally reaches the clinical record, radiographs and images, treatment plans, and billing and payment information. The patient can ask for a copy, can ask for a particular form or format where you can readily produce it, and can direct you to send it to a third party. Now the three mistakes.
Mistake one: holding records hostage over a balance. The most common and the most dangerous. The right of access is not conditioned on the account being current. Whatever your collections position is, it is a separate matter. Our accounts receivable and collections lesson covers the legitimate tools for the money side, and none of them is the chart.
Mistake two: over formalising the process. Requiring the patient to appear in person, to use only your form, to notarise something, or to explain why they want their own records adds friction the access right is not designed to tolerate. You may and should verify identity. The test is whether your process is a verification step or an obstacle course.
Mistake three: fees and delay. There are rules about what may be charged for copies and how quickly you must respond, and both have been areas of active guidance and litigation. Charging for search and retrieval time, or applying a per page rate that was fine under some other framework, is exactly the kind of thing that gets practices in trouble. Do not guess. Look up the current requirement, check your state's rules, and set your fee basis and turnaround in writing once, so the front desk is never improvising.
The related item: radiographs. "We do not release originals" is fine, since a copy satisfies the request. "Our software cannot export" is not an answer the patient has to accept, and it is worth finding out today whether yours can and how. The same goes for scanner files and CBCT volumes, which are large and awkward and therefore get postponed.
Who receives the request, how identity is verified, what gets included, what format options you can produce, what you charge and on what basis, how it is sent securely, the turnaround target, and where the request and the fulfilment get logged. Then post it where the front desk can see it. Nearly every access complaint traces back to someone improvising a policy at the counter under time pressure.
The Notice of Privacy Practices
The Notice of Privacy Practices tells patients how you may use and disclose their information, what rights they have, and how to complain. Covered entities are required to have one, to make it available, to post it, and to make a good faith effort to obtain written acknowledgement of receipt.
Two points that confuse practices regularly. First, the acknowledgement is not consent. It means the patient received the notice. It is not permission for anything in particular, and it is not a substitute for an authorisation when one is required. Offices sometimes treat that signature at the new patient visit as though it unlocked everything, and it does not.
Second, good faith effort is the standard. If a patient refuses to sign, you document the effort and the refusal and move on. You do not refuse to treat them over it, and you do not keep pushing.
The practical failure here is staleness. Notices get written once, printed, and then the practice changes: new communication methods, new vendors, new services, new state requirements, and updated federal guidance on the notice itself. A notice that no longer describes what you actually do is a document that argues against you. Put it on the annual review list, and have a healthcare attorney confirm the content is current rather than assuming the previous owner's version is fine.
Permitted Disclosures Versus Authorisations
This distinction governs most day to day decisions, and once the team has it, front desk confidence goes up noticeably.
Some uses and disclosures are permitted without a separate written authorisation. The core three are treatment, payment, and health care operations, often shortened to TPO. Referring to an oral surgeon is treatment. Submitting a claim is payment. Quality review and certain administrative functions are operations. There are additional permitted categories, including certain disclosures required by law, and situations where the patient must be given an opportunity to agree or object.
Other uses require a written authorisation. Most marketing uses, most sales of PHI, and psychotherapy notes fall here, along with anything outside what the rules permit. In dentistry the one that comes up constantly is photographs. Using a patient's before and after images on your website, in social media or in an advertisement is not a treatment disclosure. It needs a proper authorisation that actually describes what you are going to do. The practice website guide is worth reading alongside this, because marketing generates more of these questions than clinical work does.
Running underneath all of it is the minimum necessary standard: limit use and disclosure to what is needed for the purpose, with certain exceptions, notably treatment. Internally, that is the principle behind role based access. The person verifying benefits does not need clinical notes from four years ago.
A valid authorisation is not a sentence on a sticky note saying the patient said it was fine. The regulation specifies what it must contain, including a description of the information, who is disclosing and receiving it, the purpose, an expiration, the right to revoke, and signature and date. Have your forms drafted or reviewed by counsel once, then use them consistently. A form that fails on its face is worse than no form, because it documents a disclosure you cannot defend.
Amendments, Restrictions and Accounting, in Shape
Three more rights that practices meet less often and therefore handle worse.
Amendment. A patient may request that you amend information in the designated record set. This is not a right to have the record say whatever they want, and it is not a right to delete. A practice may deny in defined circumstances, for example where the record is accurate and complete or where the practice did not create it. What matters is having a process: the request in writing, a response within the timeframe the regulation sets, and denials with an explanation and the patient's right to submit a statement of disagreement that becomes part of the record. Do not simply edit a clinical note because a patient asked.
Restriction requests. Patients may request restrictions on certain uses and disclosures. Generally a practice is not obliged to agree, with one exception that matters in dentistry: where a patient pays out of pocket in full and asks that the information not go to their health plan for payment or operations purposes. That must be honoured under the conditions the rule specifies, which means a flag in your software and a team that knows what the flag means. Confirm the contours with counsel.
Confidential communications. A patient may ask to be contacted by alternative means or at an alternative location, and reasonable requests are to be accommodated. In dental terms: no messages at the home number, texts only, mail to a different address. Easy to honour, and easy to break if your reminder automation has nowhere to record the preference. Check that yours does.
Accounting of disclosures. Patients have a right to an accounting of certain disclosures. The category is narrower than it sounds, since treatment, payment and operations disclosures are generally excluded along with several others. What remains tends to be the unusual ones: certain disclosures required by law, public health reporting, and similar. The implication is that somebody has to log those when they happen, because you will not reconstruct them later. A one line disclosure log solves the whole problem.
The Spouse at the Front Desk
Now the scenario your team actually faces. A husband asks at the counter what his wife's balance is. The mother of a nineteen year old calls to ask whether her son showed up. A patient's adult daughter wants to know what treatment her father was quoted.
The instinctive responses are both wrong. Answering because the person is obviously family and obviously means well is a disclosure. Refusing flatly with "HIPAA, sorry" is accurate and makes the practice look obstructive, which is its own cost. The workable framework has three layers.
First, check whether there is a basis already on file. A valid authorisation naming that person, or documented personal representative status, settles it. Personal representatives, people with legal authority to act for the patient, generally step into the patient's shoes, and how that authority is established is a matter of state law that varies. Guardianship, power of attorney and the parent of a minor are the common ones. Minors are their own layer, because state law determines when a minor may consent to care and what parental access looks like then. Ask your attorney about your state once.
Second, consider whether the rules allow involving a person in the individual's care. There is provision for disclosing information directly relevant to a family member's or friend's involvement in care or payment, where the patient agrees, has the opportunity to object and does not, or where the practice reasonably infers agreement. That is why an assistant can give postoperative instructions to the person who drove the patient home. It is not a licence to discuss the account with anyone who claims a relationship over the phone.
Third, and this is the real answer for the front desk, default to the patient. "I am not able to discuss another person's account, but I would be glad to help you get this sorted. If Mrs. Hall calls us or adds you in writing, we can talk with you directly. Would it help if I called her now?" That sentence protects the patient, solves the problem, and does not make the practice sound like a bureaucracy. Script it, train it, and put it next to your other counter scripts. The front desk scripts collection and the difficult conversations lesson are the right companions, because tone is doing as much work here as policy.
One more front desk reality: the phone. Verifying the caller's identity is the step that gets skipped when the office is busy, and a caller who knows a name and a date of birth has demonstrated very little. Decide your verification standard and apply it every time, including to people you recognise, because the exception becomes the habit faster than anyone expects.
Try this in your own office
- Write the one page records request procedure and confirm your fee basis and turnaround against the current regulation and your state's rules, before the next request rather than during it.
- Test your export. Have someone produce a full record including radiographs in a format a patient could use, and time it.
- Read your Notice of Privacy Practices against what the practice actually does now, and have your authorisation forms reviewed by counsel, especially the one you use for photos and marketing.
- Script the family member conversation and role play it at a team meeting. Include the phone version, which is harder.
- Start the disclosure log for the unusual disclosures, and decide where the confidential communication preference gets recorded so your recall automation respects it.
THE CHAIRSIDE TAKE
Write the records request procedure this week and put the fee and turnaround in it after you have verified both against the current rules and your state's, because improvisation at the counter is where nearly every access complaint begins. Never hold records over a balance, however justified it feels. And give your team one good sentence for the family member at the front desk, because the difference between a privacy program that patients experience as protective and one they experience as obstructive is almost entirely tone. As always, confirm the specifics with a healthcare attorney. This is education, not legal advice.
Lesson 4 of 5 in HIPAA and Patient Privacy for Dental Practices
This guide is educational content and does not constitute legal, financial, tax, or clinical advice. Laws and regulations vary by state and change over time. Consult your own dental-specific attorney, CPA, and state dental board before acting.