2.3 Storing, Securing, and Disposing of Records, Including When a Practice Closes
Key Takeaways
California Civil Code § 56.101(a) requires providers to create, store, and destroy medical information in a way that preserves confidentiality.
A negligent CMIA release allows nominal damages of $1,000 without proof of actual harm under Civil Code § 56.36(b).
Health and Safety Code § 123145 requires licensed clinics that close to keep records at least seven years, and minors' records until age 19 but not less than seven years.
Medi-Cal providers must keep service records for 10 years under Welfare and Institutions Code § 14124.1.
California Civil Code § 1798.81 requires disposing of records containing personal information by shredding, erasing, or making them unreadable.
What the outline asks
Task T103 covers two knowledge statements: storage and disposal of records when closing a dental practice (K1031) and the security of stored records (K1032). Both come from the same idea: the patient's information must stay confidential, intact, and available to the patient for as long as the law expects it to exist.
Security duties while records are kept (K1032)
Civil Code § 56.101(a) requires every provider who "creates, maintains, preserves, stores, abandons, destroys, or disposes of" medical information to do so in a way that preserves confidentiality. Negligence exposes the provider to § 56.36 remedies:
| Violation | Consequence under § 56.36 |
|---|---|
| Negligent release | Nominal damages of $1,000 (no proof of actual damage needed) plus actual damages |
| Negligent disclosure | Administrative fine or civil penalty up to $2,500 per violation |
| Knowing and willful violation by a licensed professional | Up to $2,500 (first), $10,000 (second), $25,000 (third and later) per violation |
| Violation causing economic loss or personal injury | Misdemeanor |
Electronic systems have extra rules: § 56.101(b) requires an EHR to protect data integrity and automatically record every change or deletion, with the user, date, and time.
HIPAA's Security Rule adds the familiar safeguards:
- Administrative: a documented risk analysis, a named security official, workforce training, and business associate agreements with IT vendors, cloud storage, shredding companies, and record custodians.
- Physical: locked chart rooms, screens facing away from the waiting room, and control of devices and media.
- Technical: unique user logins, automatic log-off, audit logs, and encryption. Encryption matters later: stolen data that is encrypted to HHS standards is not "unsecured PHI," which can avoid breach notification (Section 2.4).
How long must records be kept?
No section of the Dental Practice Act sets a single retention period for a private dental office. Patient-access law says it does not require keeping records longer than other statutes or regulations require (Health and Safety Code § 123110(f)). Use the rules that do exist as your checklist:
| Record | Minimum | Source |
|---|---|---|
| Records of a licensed clinic that ceases operation | 7 years after discharge; minors until 1 year after age 18, never less than 7 years | Health and Safety Code § 123145 |
| Records of Medi-Cal services | 10 years from the later of the service, audit completion, or contract end | Welfare and Institutions Code § 14124.1 |
| Schedule II prescribing records | 3 years | Health and Safety Code § 11191 |
| Sterilizer spore-test results | 12 months | 16 CCR § 1005(b)(17) |
| Amalgam separator inspection records | 3 years | 40 CFR § 441.50(b) |
| CE completion certificates | 3 renewal periods | 16 CCR § 1017(n) |
Many dentists and professional liability carriers follow the § 123145 clinic benchmark or keep records longer. On the exam, a choice that says the Dental Practice Act requires exactly seven years for every private office is a trap.
Disposal
When records may be destroyed, they must be destroyed completely. Civil Code § 1798.81 requires businesses to dispose of records containing personal information by shredding, erasing, or otherwise modifying them so they are unreadable. For paper, that means cross-cut shredding or pulping by a bonded vendor under a business associate agreement. For electronic media, it means wiping or physically destroying hard drives, digital sensors, and backup media rather than simply deleting files. Throwing charts in a dumpster violates both § 1798.81 and § 56.101.
Closing or selling a practice (K1031)
When a practice closes, patients still have the right to their records under Health and Safety Code § 123110 (Section 2.5). For licensed clinics, § 123145 treats leaving patients without access as abandonment of records and lets injured patients sue, including principal officers of a dissolved corporation. The same principles guide a private office:
- Appoint a custodian. A buying dentist, a remaining partner, or a professional storage company must agree in writing to keep the records secure and respond to requests.
- Tell patients. Send notice of the closure or sale and explain how to get copies or transfer records. The CDA Code (Advisory Opinion 1.B.2) says patients of a departing dentist have the right to that dentist's new contact information when it is known.
- Keep original radiographs and records available. The custodian must honor inspection and copy deadlines.
- Do not sell records as a commodity. A practice sale transfers custody for continuing care. Civil Code § 56.10(d) forbids selling medical information for purposes unrelated to care.
If a dentist dies or becomes incapacitated, B&P § 1625.3 lets an executor, conservator, or qualifying trustee employ licensees to run the practice for up to 12 months after notice to the Board, without controlling professional judgment. Records stay with the practice during that period.
Tip
Security and access go together. The custodian who locks records away so well that no patient can get a copy has still failed the law.
A dentist plans to retire and close her solo private practice. Which step best protects patients' legal rights to their records?
Return every original chart to its patient on the last day of practice
Shred all charts older than three years and keep only recent ones
Leave the records in the closed office because the Dental Practice Act has no retention rule
Arrange in writing for a custodian to keep the records secure and respond to requests, and notify patients how to obtain copies
An office puts old patient charts in the regular trash bin behind the building. Which statement is correct?
The disposal is lawful once the charts are more than seven years old
The disposal is lawful if the bin is locked
The disposal violates the duty to destroy records in a way that preserves confidentiality, exposing the office to CMIA damages and penalties
Only the waste hauler is liable once the charts leave the building
A dental practice treats Medi-Cal beneficiaries. For how long must it retain records of the Medi-Cal services it provides?
Three years from the service date
Ten years from the latest of the service date, the audit completion date, or the contract end date
Seven years from the patient's last visit, or until age 19 for a minor
Until the patient's Medi-Cal eligibility ends
Sections you finish are checked off in the contents.