What you may share — and what needs a signature
No permission needed
- Referrals, lab cases, talking to the dentist
- Sending records to the patient’s physician
- Claims, statements, verifying benefits
- Scheduling, audits, staff training
Minimum necessary: share the smallest amount that does the job. The one exception is treatment — a provider who needs the record gets what they need.
Signed authorisation required
- Before-and-after photos, anywhere public
- Testimonials, reviews, case studies
- Anything for marketing
- Requests from an employer or a lawyer
- A family member not involved in their care
Removing the name does not remove the requirement.
The five things a patient can ask for
| A copy of their record | 30 days. One further 30 days only if you write to them inside the first 30 saying why and when. Cost-based fee for copying, supplies and postage — no search or retrieval fee. |
| An amendment | You may refuse, but in writing, and they may file a statement of disagreement that stays with the record. |
| An accounting of disclosures | Where their information went over six years — excluding routine treatment, payment and operations. |
| A restriction | Usually you may decline — except the one below. |
| Confidential communications | A different number or address. Accommodate reasonable requests, and do not ask why. |
Answering an online review
Never say
“We saw you on the 14th and offered to reschedule.”
That confirms they are a patient, when they came and what happened. Practices have been fined for exactly this.
Safe to say
“We take all feedback seriously. Please call the office so we can talk.”
Reveals nothing. The patient may say anything about their own care. You may not.
If something goes wrong
Call first, count days later. Tell patients within 60 days of discovery. For 500 or more people, tell HHS at the same time, plus the media in that state. Under 500, HHS gets an annual log within 60 days of year end. The clock runs from discovery.
Keep for six years: policies, incident records, risk analyses, business associate agreements, training records, and signed Notice of Privacy Practices acknowledgements.