Were your dental records abandoned in a storage unit in Memphis?
by Olivia Wann, JD
Imagine the frustration of patients living in Memphis who were treated by a local dentist whose records were left behind in a storage unit.
According to the individual who purchased the contents of an abandoned storage unit, he found thousands of dental records to include x-rays, intake forms, billing records and billing information that included patients’ social security numbers. He was quoted as saying, “This wasn’t one or two files, this was thousands of thousands of files.”
Evidently the dentist stored the files in the storage unit after having closed his office in Memphis. I looked up his license on the TN Department of Health website which indicated he was licensed September 10, 1981, and his license expired July 31, 2023. The only previous discipline on record was failure to maintain sufficient continuing education credits.
Likely the dentist retired and closed his office and unfortunately stored the patient records improperly. When the dentist failed to pay the storage unit fees for a few months, the contents were sold. The buyer was quite surprised and disturbed to find sensitive documents left behind.
How should a retiring dentist properly store or dispose of records, particularly older paper files? First, let’s establish how long you must retain the record. The record retention rules may vary. Consult your state’s Dental Practice Act.
According to Chapter 0460-02 of Tennessee’s , retention of records shall be retained for a period of not less than SEVEN (7) years from the dentist’s or his supervisee’s last professional contact with the patient except for the following:
- Dental records for incompetent patients shall be retained indefinitely.
- Dental records of minors shall be retained for a period of not less than one (1) year after the minor reaches the age of majority or seven (7) years from the date of the dentist’s or his supervisees’ last professional contact with the patient whichever is longer.
- Notwithstanding the foregoing, no dental record involving services which are currently under dispute shall be destroyed until the dispute is resolved.
Rather than leaving records behind or storing such records improperly, it’s best to properly destroy the records. As long as you have satisfied the aforementioned requirements, destruction of the records accomplishes two things: 1) You are freed of the responsibility to store the records plus you save space and money, and 2) You have complied with federal HIPAA and your state’s Dental Practice Act in maintaining the confidentiality of the records.
The Department of Health and Human Services indicates that disposal of paper records includes shredding, burning, pulping, or pulverizing the records so that the PHI is rendered essentially unreadable, indecipherable, and otherwise cannot be reconstructed. [1]
In Tennessee, records are destroyed by burning, shredding, or other effective method in keeping with the nature of the records according to Tenn. Comp. R. & Regs. 0460-02-.12. Most retiring clinicians engage a shred service company.
What kind of documentation must you maintain? Once again, we look to the Dental Practice Act. According to Tennessee’s requirement, we document the date and time, not necessarily the individual records but sufficient information to identify the group. For example, “Patient Records A – M, 2000 to 2005, Shredded via XYZ Shred Service.”
This is especially important information for retiring dentists who are selling their dental practices. The seller dentist must ensure that all the records are transferred in a confidential manner. If the buyer dentist sees a bunch of old, boxed-up paper files, this is a valid point to negotiate. It’s valid to ask the seller dentist to properly dispose of these records prior to the buyer assuming responsibility.
Additionally, Tennessee’s Dental Practice Act requires that patients treated during the preceding 36-months of the transfer be notified of the buyer dentist assuming custody of their records and if the individual requests, copies of the record may be sent to another dentist of their choice. If the patient remains with the practice, a new patient registration form and consent is completed at the next date of service.
We are all patients. Just like we want our information protected, we want to assure the confidentiality of the records of the patients we have treated over the years.
Modern Practice Solutions has been serving the compliance needs of the dental profession since the year 2000. For your HIPAA training and policy needs, contact us (931) 232-7738.
[1] https://www.hhs.gov/hipaa/for-professionals/faq/575/what-does-hipaa-require-of-covered-entities-when-they-dispose-information/index.html, accessed on January 2, 2025
Author
