Are Dental Records Considered Medical Records Under HIPAA?

Dental records are considered medical records under HIPAA. Any dentist who sends claims or other health information electronically is a HIPAA covered entity, which means your dental chart, x-rays, treatment notes, and billing history are Protected Health Information with the same federal safeguards as records from a hospital or physician’s office.¹ That classification gives you real, enforceable rights: you can see the records, get copies, ask for corrections, and have them sent to another provider or an attorney.

Why a Dental Practice Falls Under HIPAA

The Health Insurance Portability and Accountability Act of 1996 doesn’t sort providers by specialty. A dental office becomes a covered entity the moment it transmits any health information electronically for a standard transaction, such as submitting a claim to an insurance company. The federal regulation defines a covered entity as “a health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter,” and HHS explicitly lists dentists alongside doctors, clinics, pharmacies, and nursing homes.²

Once that threshold is crossed, everything individually identifiable in the file becomes PHI. Treatment notes, radiographs, periodontal charts, diagnoses, billing history, your name, address, date of birth, and insurance details all qualify. The Privacy Rule protects this information whether it lives on paper, in a practice management system, or in a conversation between staff members.³

A small caveat: a dentist who runs a strictly cash practice and never transmits anything electronically may fall outside HIPAA. In modern practice that’s rare, because nearly every office bills insurance or verifies eligibility electronically at some point.

What Rights You Get as a Result

Because your dental records are PHI held by a covered entity, you have a federal right to inspect them and obtain copies. That right covers a broad set of materials: clinical notes, radiographs, periodontal charts, billing and payment records, insurance information, lab results, and anything else used to make decisions about your care.⁴ You can ask for paper copies, electronic copies, or both, and the practice has to provide the format you request if it’s readily producible that way.

Your access right lasts as long as the office maintains the information, no matter when treatment happened or whether the files sit on-site or in off-site archives.⁴

You can also direct the office to send your records straight to a third party, such as a new dentist, an orthodontist, a physician, or an attorney. A third-party direction has to be in writing, signed by you, and clearly identify the recipient and the delivery address.⁵ The dental office must comply; it cannot insist on giving records only to you and making you relay them.

How to Request Your Dental Records

HIPAA does not automatically require a written request, but a practice may require one if it tells you about that policy in advance.⁴ Most offices do ask you to sign a form because it creates a clear paper trail. Either way, be ready with your full name, date of birth, and enough detail to identify what you need: your entire file, x-rays from a specific period, billing records only, and so on.

The office has 30 days from the date it receives your request to either provide the records or give you a written explanation for the delay. It can extend that window by one additional 30-day period, but only with written notice explaining the reason and setting a firm completion date.⁵ Only one extension is allowed, so the maximum wait is 60 days.

What Copies Cost

A dental practice can charge a reasonable, cost-based fee for copies. The fee can cover labor for copying, supplies like paper or a USB drive, and postage if you want the records mailed. It cannot include the cost of searching for or retrieving the records.

For electronic copies of records the office already keeps electronically, HHS allows a shortcut: a flat fee of no more than $6.50 per request instead of an itemized cost calculation. The flat fee is an option, not a cap. A practice with higher demonstrated costs can charge more as long as it uses the cost-based method the Privacy Rule allows.⁶ If a charge looks high, ask for an itemization.

When a Dental Office Can Legitimately Refuse

Outright denial is uncommon, but HIPAA does allow it in a few narrow situations, and some of these denials are final with no right to a second review. Psychotherapy notes, information compiled in anticipation of a lawsuit, material outside the designated record set (internal quality-assurance files, peer review, business planning), and information obtained from a non-provider under a promise of confidentiality can all be withheld.

A smaller category of denials is reviewable. A licensed health professional can deny access if, in their professional judgment, releasing the records would endanger your life or someone else’s physical safety, or if the records reference another person and access could cause that person substantial harm.⁵ For reviewable denials, you can ask the practice to have a different licensed professional take a second look.

Even where a specific note is excluded, the rest of the file stays accessible. A denial of one document does not block access to everything else.⁴

Correcting Errors in Your Chart

If you spot a mistake, such as a wrong allergy notation, an incorrect procedure code, or a billing entry that doesn’t match what happened, you can ask the office to amend the record. The practice has 60 days to act on an amendment request, with one possible 30-day extension if it explains the delay in writing.⁷

The office can decline to amend if the record is already accurate and complete, the information wasn’t created by that practice, it isn’t part of the designated record set, or it wouldn’t be available for inspection under the access rules.⁷ A denial has to come to you in writing. You then have the right to submit a written statement of disagreement, which the practice must keep in your file and include any time it later discloses the disputed information.

How Long Records Stick Around

One thing HIPAA does not do is set a retention period for your clinical chart. HIPAA requires covered entities to keep their compliance documentation — written policies, training logs, and similar administrative paperwork — for at least six years, but that rule doesn’t govern patient records themselves.⁸ Retention rules for the chart come from state law and vary widely, with special protections often applied to records of minors. If you might need older records, request copies before switching dentists or if you learn your current practice is closing or being sold.

Filing a Complaint if a Practice Ignores Your Rights

If a dental office ignores your access request, charges an unreasonable fee, or refuses to release records without a valid legal reason, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. You have 180 days from the date you learned of the violation, though OCR may extend that deadline if you show good cause.⁹

Complaints can be submitted through the OCR Complaint Portal at ocrportal.hhs.gov, or by mail, fax, or email. You’ll need your name and contact information, the name and address of the dental practice, and a description of what happened and when.¹⁰ Anonymous complaints aren’t investigated, but the practice is prohibited from retaliating against you for filing.⁹

1
U.S. Department of Health and Human Services. Covered Entities and Business Associates
2
eCFR. Title 45 CFR 160.103
3
U.S. Department of Health and Human Services. Summary of the HIPAA Privacy Rule
4
U.S. Department of Health and Human Services. Individuals’ Right under HIPAA to Access their Health Information
5
eCFR. Title 45 CFR 164.524
6
U.S. Department of Health and Human Services. $6.50 Flat Rate Option is Not a Cap on Fees
7
eCFR. Title 45 CFR 164.526
8
American Dental Association. Record Retention
9
U.S. Department of Health and Human Services. How to File a Health Information Privacy or Security Complaint
10
U.S. Department of Health and Human Services. Filing a Health Information Privacy Complaint