How to Request Dental Records From Your Dentist

To request dental records from your dentist, submit a signed, written request that identifies you, lists the records you want, and states how you’d like to receive them. Under the HIPAA Privacy Rule, your dentist’s office must act on that request within 30 calendar days and can charge only a reasonable, cost-based fee for copies.¹ The original chart stays with the practice; you get copies.

Your right of access covers everything the dentist uses to make decisions about your care: clinical notes, X-rays, treatment plans, consent forms, and billing records.¹ HIPAA applies to dentists who transmit health information electronically, such as filing insurance claims, which describes almost every practice.² A cash-only office that never bills electronically may fall outside HIPAA, but state law typically gives you a similar right of access.

What to Put in Your Written Request

The office can require your request in writing.¹ Many practices have a form at the front desk or on their website. If not, a letter or email works. Include:

Your full legal name, plus any prior names the office might have on file.
Your date of birth.
Current address, phone, and email.
The specific records you want: X-rays, clinical notes, treatment plans, billing statements, or the complete chart. Include date ranges if you only need a specific period.
Your preferred format: paper, CD or USB drive, secure email, or patient portal delivery. You can ask for a specific format, and the office should accommodate you if the records are readily producible that way.
Your signature and the date.

The office may verify your identity before releasing anything. HIPAA permits this but doesn’t prescribe a method, and the verification process cannot create unreasonable barriers or delays.¹ Expect to show ID in person or confirm identifying details on the form.

How to Submit the Request

You can send the request by mail, fax, secure email, patient portal, or drop it off in person. What matters is proof of delivery, because the 30-day clock starts when the office receives it.

Certified mail with return receipt gives you dated confirmation. A fax cover confirmation page works too. If you use a patient portal, screenshot the submission. If you hand it in, ask for a dated receipt from whoever accepts it. Address the request to the records department or office manager rather than leaving it with the first person at the front desk, which is where “we never got that” delays tend to happen.

How Long the Office Has to Respond

A covered entity must act on your access request within 30 calendar days of receiving it. The office can take one 30-day extension only if it sends you a written explanation and a new completion date within the original 30-day window.³ Thirty days is the outer limit, not the target. Offices on electronic health records often turn requests around in days.

What the Office Can Charge You

Fees must be reasonable and cost-based. Allowable charges cover the labor of copying, supplies such as paper or a USB drive, and postage if you want the records mailed.⁴ Time spent searching the file, reviewing the request, or deciding what to release is not billable to you.

For electronic copies of records the office already keeps electronically, the practice has a shortcut: it may charge a flat fee of up to $6.50 that covers labor, supplies, and postage.¹ Offices that calculate actual allowable costs instead may charge a different amount, but the fee still has to be reasonable and cost-based. For paper copies, many states set per-page maximums, commonly around $0.50 to $1.00 per page, though rates vary. If the number you’re quoted looks high, ask for a written breakdown.

An Unpaid Bill Is Not a Reason to Withhold Your Records

A dental office cannot refuse to release your records because you owe money. Federal rules are explicit: a covered entity may not deny access to your health information on the grounds of an outstanding balance.⁵ The office can still bill you for the copying fee and pursue the underlying balance through normal collections, but holding the records is not a legal option.

Requesting Records for Someone Else, or Sending Them Elsewhere

Your Child’s Records

Parents generally act as a child’s personal representative under HIPAA and can request the child’s dental records. Narrow exceptions apply: when a child consented to treatment on their own under state law and parental consent wasn’t required, when a court directed the child’s care, or when the parent agreed to a confidential relationship between the child and the provider.⁶ A provider can also withhold records from a parent when there is a reasonable belief that the child may be subject to abuse or neglect.

Records of a Deceased Patient

HIPAA protects a deceased person’s health information for 50 years after death. During that time, the executor, administrator, or other person authorized under state law to act for the deceased or the estate has the same access rights the patient would have had.⁷ Expect to provide letters testamentary or a comparable court appointment along with a death certificate.

Sending Records to a New Dentist or Attorney

You can direct your dentist to send copies straight to a third party such as a new dental provider, an orthodontist, or a lawyer. The instruction must be in writing, signed by you, and identify the recipient and where to send the records.¹ The same 30-day timeline and fee rules apply. If a third party asks the office for your records directly without going through you, the office will generally need a signed HIPAA authorization from you first.

If the Office Won’t Comply

Start with a direct conversation with the office manager. Most delays are logistical rather than intentional, and a phone call resolves them faster than any formal channel.

If that doesn’t work, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. OCR investigates covered entities for violations of the HIPAA Privacy, Security, and Breach Notification Rules.⁸ File within 180 days of when you knew or should have known about the violation; OCR can extend that deadline for good cause.⁹ Complaints go through the OCR portal online, by email at OCRMail@hhs.gov, or by phone at 1-800-368-1019. Grounds for a complaint include ignoring your request, blowing the deadline without written notice, charging unreasonable fees, or refusing to release records for an illegitimate reason such as an unpaid bill.

When the Practice Has Closed

A closed practice doesn’t erase your records. The former owner remains responsible for maintaining patient records after closing, either personally or through a third-party records custodian. Practices are expected to notify patients before closing and explain where records will be held.

If you weren’t notified or can’t reach the old office, contact your state dental board, which often maintains information on closed practices and their designated custodians. If the practice was sold, the purchasing dentist may now hold your chart. Your dental insurance carrier may also have current contact information for the successor practice. If none of that works and you believe records were mishandled, an OCR complaint is available.

1
HHS.gov. Individuals’ Right Under HIPAA to Access Their Health Information 45 CFR 164.524
2
HHS.gov. Covered Entities and Business Associates
3
Health Information Privacy (HHS). How Timely Must a Covered Entity Be in Responding to Individuals’ Requests for Access to Their PHI
4
U.S. Department of Health & Human Services. May a Covered Entity Charge Individuals a Fee for Providing a Copy of Their PHI
5
U.S. Department of Health & Human Services. May a Health Care Provider Withhold a Copy of an Individual’s PHI Because of an Outstanding Bill
6
Department of Health & Human Services – Office for Civil Rights. The HIPAA Privacy Rule and Parental Access to Minor Children’s Medical Records
7
HHS.gov. Health Information of Deceased Individuals
8
U.S. Department of Health & Human Services – Office for Civil Rights. Complaint Portal Assistant
9
HHS.gov. How to File a Health Information Privacy or Security Complaint