In almost every situation, no — your dentist cannot refuse to give you your X-rays. Under the HIPAA Privacy Rule, dental practices that bill insurance electronically have to provide you with copies of your health information, including X-rays, within 30 days of a written request.1HHS.gov. Individuals’ Right under HIPAA to Access their Health Information 45 CFR 164.524 The legal grounds for a true denial are narrow and specific, and they do not include an unpaid bill, a disputed insurance claim, or a disagreement about your treatment.
The 30-Day Rule
Once you make a request, the dental office has 30 calendar days to give you access. If the records sit in offsite storage or are otherwise not readily available, the office can take one additional 30-day extension, but it has to notify you in writing during the first 30 days, explain the delay, and give you a specific date to expect the records.1HHS.gov. Individuals’ Right under HIPAA to Access their Health Information 45 CFR 164.524 Only one extension per request is allowed. An office that keeps pushing you off week after week is not following the rule.
HIPAA sets the minimum. State laws can require faster turnaround or broader access, and the dental practice has to follow whichever standard protects you more.2American Dental Association. Releasing Dental Records
How to Ask for Your X-Rays
The office can require your request in writing. That is the limit of what they can demand procedurally. You do not need to sign a formal HIPAA authorization form to get your own records — HHS has said explicitly that requiring one for your own access request creates an impermissible obstacle, because those forms ask for information that isn’t necessary or relevant.1HHS.gov. Individuals’ Right under HIPAA to Access their Health Information 45 CFR 164.524 If the front desk insists on an authorization form, point that out. A short written request is enough.
Be specific about what you want. “Copies of all X-rays taken between January 2024 and March 2026” works better than “my records.” If you want them sent directly to another dentist or specialist, include that provider’s name, address, and your signature directing the transfer.
Choosing the Format
You can request a particular format, and the office has to accommodate you if it can readily produce the records that way. For X-rays stored digitally, the practice must give you the electronic copy in the format you ask for — PDF, DICOM image file, or another standard format — as long as its system can generate it.1HHS.gov. Individuals’ Right under HIPAA to Access their Health Information 45 CFR 164.524 If the system truly can’t produce your requested format, you and the office have to agree on a readable alternative. What they can’t do is hand you a paper printout of a digital X-ray when you specifically asked for the electronic file and their software supports it.
What the Office Can Charge
Fees have to be reasonable and cost-based, and they can only cover four things: labor for copying, supplies (like a CD or USB drive if you want portable media), postage if you want the records mailed, and preparation of any summary you agreed to accept in place of full records.1HHS.gov. Individuals’ Right under HIPAA to Access their Health Information 45 CFR 164.524 The fee cannot include the cost of searching for or retrieving the records, maintaining the filing system, or general overhead.
For electronic copies of electronically maintained records, an office that doesn’t want to calculate actual costs can charge a flat fee of up to $6.50 per request.3HHS.gov. $6.50 Flat Rate Option is Not a Cap on Fees That figure is a convenience option, not a hard cap. An office can charge more if it can document that actual costs are higher. In practice, though, emailing you a digital X-ray carries very little legitimate cost. If a quoted fee looks inflated, ask for an itemized breakdown.
The Narrow Grounds for a Legal Denial
Federal regulation spells out when a dentist can actually refuse. The grounds break into two categories.
Denials You Cannot Appeal
An office can deny access without offering review if the information came from a non-provider source under a promise of confidentiality and releasing it would likely reveal that source; if the records are subject to the federal Privacy Act, which applies to certain government-maintained records; or if the information was created during a clinical research study where you agreed in advance that access would be suspended until the study ended.4eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information None of these come up in ordinary dental care.
Denials You Can Challenge
A dentist can also deny access on reviewable grounds if a licensed healthcare professional determines that releasing the records is reasonably likely to endanger the life or physical safety of you or someone else, that the records reference another person and releasing them would likely cause that person substantial harm, or that providing records to a personal representative (such as a parent or guardian) could cause substantial harm to you or someone else.4eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information If the office denies you on any of these grounds, you have the right to have another licensed professional review the decision, and the office has to tell you how to request that review.
Look at what isn’t on either list: unpaid bills, pending insurance claims, malpractice disputes, internal audits, or disagreements about treatment. If a dental office cites any of those, the denial is almost certainly a HIPAA violation.
An Unpaid Bill Doesn’t Block Your Records
This is the most common wrongful denial patients actually run into, so it deserves its own emphasis. A dental office cannot withhold your records because you owe money. HHS has said so directly: just as a dentist may not deny access over an unpaid bill, the office also may not take the copy fee you pay and apply it to your outstanding balance instead of fulfilling the request.1HHS.gov. Individuals’ Right under HIPAA to Access their Health Information 45 CFR 164.524 The debt and the records request are legally separate. The office can pursue the bill through normal collection channels. It cannot hold your X-rays hostage while it does.
“We Own the Records” Isn’t a Refusal
Some offices lean on the idea that they own the records as a reason to make you jump through hoops. In most states, the practice does own the physical or electronic record itself, because the practice paid for the equipment, staff time, and storage. But owning the medium is not the same as owning the information. You have the right to the data in those records, which means you are entitled to copies in a usable format even though the originals stay with the office. That right exists whether you are switching dentists, getting a second opinion, or just keeping a personal health file.
When the Records May No Longer Exist
One legitimate reason an office might not produce your X-rays is that they no longer exist. State laws set how long dental practices have to retain patient records after the last visit, and those periods vary. Most states land around seven years, with a range running roughly from five to eleven years for adults. Records for minors typically have to be kept longer, often until the patient reaches the age of majority plus additional years.
If you left a practice more than a decade ago and never returned, the office may have lawfully destroyed your file. Request copies while the records are still available, especially before switching providers. Once the retention period runs out, the office has no obligation to have kept them.
What to Do When Your Dentist Refuses
Start with a direct conversation. A lot of refusals come from front-desk staff who don’t know the rules, not from a deliberate decision by the dentist. Say that HIPAA requires the practice to provide copies of your X-rays within 30 days and that unpaid balances, pending insurance claims, and administrative inconvenience are not valid reasons for delay.1HHS.gov. Individuals’ Right under HIPAA to Access their Health Information 45 CFR 164.524 Put the request in writing if you haven’t already, and keep a copy. A paper trail matters if you have to escalate.
If the practice has a compliance officer or practice manager, ask to speak with them. Group practices sometimes have policies their reception staff misapply, and someone with actual authority can resolve things fast.
Filing a HIPAA Complaint
If the office still won’t cooperate, file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. You have 180 days from when you became aware of the violation, though OCR may extend that deadline for good cause.5HHS.gov. HIPAA What to Expect You can file online through the OCR Complaint Portal, by email to OCRComplaint@hhs.gov, or by mailing a written complaint to the Centralized Case Management Operations office in Washington, D.C.6HHS.gov. How to File a Health Information Privacy or Security Complaint
Your complaint has to name the dental practice, describe what happened, and give the date the violation occurred. Include the dates of your requests, any written correspondence, and the reason the office gave for the denial. Learning that an OCR complaint has been filed is often enough to get a practice to cooperate.
Complaining to Your State Dental Board
You can also file a complaint with your state dental board, and you can do it alongside an OCR complaint. Dental boards investigate patient complaints about professional conduct, and inappropriately withholding records can fall under that. Outcomes range from dismissal to formal discipline, including letters of reprimand, fines, required supervision, and in serious cases, license suspension or revocation. The board can also order a partial or full refund of fees connected to the complaint.
Document every interaction from the beginning: the date of each request, who you spoke with, what they said, and any written responses. That record makes both OCR complaints and dental board complaints much stronger — and most disputes never reach that stage once the dentist realizes you know the process.