Multiple laws and regulations govern how and under what circumstances dental records can be shared. To help you gain a better understanding of the sometimes confusing guidelines surrounding dental record access, retention and disposal, following are responses to a number of frequently asked questions on this topic.
Who Owns Dental Records?
The dentist owns the records, but the patient owns the information contained in the records. For this reason, the patient has a right to examine and/or obtain a copy of his or her records at any time.
Wisconsin Statute 146.83(1)(2)(3) Patient Access to Health Records provides that a patient (or a person authorized by the patient) has the right to inspect his or her own dental records during regular business hours if he or she gives reasonable notice to the dentist of a desire to so inspect, and submits a signed statement of “informed consent” stating the purpose of the inspection, the type of information sought, and the name of any person authorized to inspect or receive the information and the date.
The dentist should record the time and date of each request, the name of the inspecting party, time and date of the inspection, the type of information sought or released, the time and date of the release and the name of any person authorized to receive the information.
Section 146.83(2) requires that the dentist shall provide each patient with a statement paraphrasing the provisions of this section either upon admission to an inpatient care facility or upon the first provision of services by the health care provider.
The patient may obtain copies of the dental records by paying a copying cost as outlined in other portions of this paper. A person authorized to inspect or receive information on behalf of a patient includes a parent, guardian, custodian or an agent. The dentist is not required to and should not relinquish physical possession of the original records. But the dentist has an absolute legal duty to comply with the request for a copy or transfer of the records to whomever the patient desires with little or no interference.
Dental records include x-rays, treatment notes and any material that pertains to the patient’s dental health.
“Informed Consent” for Release of Records
Both HIPAA (45 C.F.R. 164.508 (c)(vi)) and Wisconsin law (Wis. Stat. 146.81(2)(f)) specifically provide that an authorization to release medical records must include the signature of the individual making the request.
The signature may be an original, a copy of the original or a signature received via facsimile or in the form of a PDF attachment to an e-mail.
There is an increase in the sensitivity to patient confidentiality and the ability for anyone to make a request via the internet. So, is receipt of an e-mail request for medical records compliant with the law? Recent advice recommends that a request via the internet is not sufficient (absent of a PDF signature) to satisfy statutory requirements. E-signatures, in some circumstances, may be sufficient to create binding contracts under Wisconsin law, but we would advise against relying upon them as authorization for the release of patient records.
Who Has Access to a Deceased Patient’s Records?
HIPAA protects patient records even following death. The dental office must treat a deceased patient’s records with the same level of confidentiality as prior to their death.
After a patient’s death, the deceased’s personal representative has the right to request and review records. The dental office should require of that person the official court-certified document (“Domiciliary Letters” or “Testamentary Letters”) naming or appointing the person requesting the records as personal representative.
In some instances, because of advanced age or limited mental capacity, the person may have had a personal representative with access to their records prior to death. That same person may be the one appointed as personal representative following death. Although prior to death the personal representative had access to the patient’s records, after death, they are to provide the court-certified appointment letters certifying them as guardian or personal representative prior to accessing the records.
Regarding a deceased child, the parent of a minor may continue to access records after the minor’s death without a court appointment. This is predicated on the fact that there was a normal parental relationship and the parent had authority to access the minor’s records in life.
According to HIPAA, the deceased’s records may be provided to persons or agencies under certain circumstances:
- If ordered by a court or authorized agency
- Pursuant to a subpoena (there should be evidence that the deceased’s personal representative was notified and had an opportunity to object)
- To a law enforcement agency to alert them of the death, especially if there is some suggestion that the death resulted from criminal activity
- To a coroner or medical examiner for identification or determination of the cause of death purposes
- To funeral directors to the extent necessary to the discharge of their duties
- To organ procurement organizations authorized to act with respect to the body
- To an authorized public health authority to collect information for the purpose of disease control
The law also allows for other “special circumstances” applicable to records of both living and deceased patients, but they are remote and generally unlikely so are not listed here. If questions arise outside normal situations, an attorney should be contacted.
What Happens When a Dentist Leaves a Practice?
No matter the reason, including retirement or death, when a dentist leaves or ceases to practice, Wisconsin law Section 147.819(1) requires that the dentist must provide for maintenance or destruction of patient records.
The individual maintaining the records should state in writing that the records will either be maintained in accordance with Wisconsin law, or destroyed. This arrangement is commonly found in connection with the sale or the assumption of a practice where the incoming dentist would agree to maintain the records. Section 146.819(1)(a) specifies that the person maintaining the records must agree to keep them in accordance with Sections 146.81 to 146.835 of the statutes. It would be wise to make reference to those sections in the agreement.
The other choice is to destroy the records. If that is the case, refer to the section below regarding disposal of dental records.
In either case, notice must be sent to each patient by first class mail or through an appropriate newspaper notice that the records will be maintained or destroyed. If the records are going to be destroyed, the patient must be given an opportunity to retrieve the records at least 35 days prior to destruction. If the records are retained, a minimum of ten years is recommended.
Police Request for Dental Records
If and when a provider is asked by the police department for a patient’s dental records, should the provider comply?
Both HIPAA (the Health Portability and Accountability Act of 1996) and Wisconsin statutes protect the privacy of patients’ dental and medical records except in certain limited situations. In fact, the HIPAA and Wisconsin protections are not identical – meaning that in the absence of patient consent, you may disclose records only where such disclosure is permissible under both HIPAA and Wisconsin law (such as in a child abuse situation).
In terms of law enforcement-related record disclosure, HIPAA is generally more liberal than Wisconsin law--making Wisconsin’s more restrictive limitations the controlling ones. Wisconsin has no specifically authorized provisions for disclosure of records to law enforcement officials other than those related to child abuse. Section 146.82(2) of the Wisconsin Statutes describes a number of instances where records can be given, without parent consent, to different government agencies. You may wish to review those exceptions depending on the situation; however, none of the exceptions would cover a general request from the police.
The Wisconsin provision most likely to apply in police situations is Section 146.82(a)(4), which authorizes the dentist to provide records pursuant to an order of a court. Thus, if dentists are requested by a law enforcement agency to provide records, the advice generally would be to respond in a helpful and courteous fashion–let them know the practice will do whatever it can to help. Explain the general confidentiality requirement and ask them to identify a specific statutory provision that would allow the records to be made available. If they are unable to identify a specific statutory provision, again let them know the practice will help and would be happy to provide whatever they need pursuant to a court order.
How Long is a Dentist Liable for Treatment Provided?
Statutes of Limitation
The statute of limitations for dental malpractice actions based upon an injury arising from any treatment or any omitted treatment by a dentist is WI Stats. 893.55(1m)-(b).
The statute provides that the action must be commenced within the later of:
- three years from the date of the injury; or
- one year from the date the injury was discovered, or in the exercise of reasonable diligence should have been discovered; and
- in no case more than five years from the date of the act or omission.
There are several exceptions to the statute of limitations:
- 893.55(2) the five year limit does not apply if a dentist conceals from a patient a prior act, omission or if a misdiagnosis occurred more than five years before the exercise of reasonable diligence should have discovered the concealment.
- 893.55(3) provides that when a foreign object, which has no therapeutic or diagnostic purpose or effect, has been left in the patient's body, the action must be commenced within one year after the patient is aware or, in the exercise of reasonable diligence should have been aware of the presence of that action.
Other Statutes of Limitations
There are several different statutes of limitations that may apply depending on the alleged injury and the legal theory under which the action is brought.
- If a patient alleges that a dental provider breached a contract to provide reasonable care, suit must be brought within six years of the breach.
- If a patient brings suit alleging an intentional tort (such as libel, slander, assault, or battery), the statute of limitations is three years. The statute of limitations may be extended for up to an additional year if a patient who is entitled to bring an action dies before the original statute of limitations has run. In that case, the deceased’s estate can pursue the claim.
- If a patient is insane or imprisoned, the statute is extended until two years after the disability ceases or the person is released.
Statute of Limitation Application to Minors
The statute of limitations which applies in an action by a minor (under the age of 18) against a dentist is WI Stats. 893.56. This statute provides that the action must be filed within the later of the time periods set out in 803.55, or by the time the minor reaches the age of 10 years. The parent, guardian or other person having custody of the minor must bring such an action. One exception is that if a minor is not yet 10 years old when the statute of limitations would have otherwise expire, the limitation period is extended until the minor’s 10th birthday.
How Long Should Dental Records be Retained?
It is important that a dentist being sued for malpractice has the original dental records to support his or her position rather than relying on memory. Attorneys for liability insurance carriers recommend that dental offices maintain records "forever." Although keeping records forever is ideal, it may pose challenges from a storage standpoint. Options to consider are off-site storage facilities, or putting records on microfiche or microfilm. Some practices destroy records 10 years after the last date of treatment of inactive patients. Records may be destroyed one year after a patient has died, or if the only treatment a patient received was an exam and cleaning. However, records for active patients and patients who received extensive treatment should be retained indefinitely.
How Are Dental Records and X-Rays Properly Disposed?
When a dental practice decides to dispose of patient records, there are several requirements imposed by Wisconsin law, Section 895.505 that must be complied with for the purpose of protecting personal information. “Personal health information” (PHI) includes details about a medical condition and treatments that could be associated with a particular person because of the circumstances described or personal information such as the patient’s name, address, social security number, etc.
Before disposing of patient records, a dental practice must either 1) shred or 2) modify them by making any personal information they contain unreadable. In addition, dental practices must take steps to ensure that personal information in any disposed records will not be accessible to unauthorized persons, until such time as the records can be destroyed. A dentist who fails to comply with these requirements could face up to $1,000 in fines and be held liable by a court for resulting damages suffered by a patient.
In seeking a records disposal company, dental offices may wish to contact a local hospital to get the name of the company they use. The dental office can then contact that company.