2.1 Confidentiality and Releasing Patient Information

Two privacy laws, one chart

Most California dental offices are covered entities under HIPAA because they bill insurers electronically. Every California dentist is also a "provider of health care" under the Confidentiality of Medical Information Act (CMIA), Civil Code § 56 and following, whether or not they bill electronically. When the two differ, follow the stricter rule.

What makes information confidential (K1017)

Under HIPAA, protected health information (PHI) is individually identifiable information about a person's past, present, or future health, the care they received, or payment for that care, held in any form: paper, electronic, or spoken. Information is individually identifiable if it names the person or gives a reasonable basis to identify them. A recall postcard, an appointment book, an intraoral photo with a name, a ledger showing a crown fee, and a voicemail about a biopsy all contain PHI. Information stops being PHI only when it is de-identified: either the listed identifiers (names, addresses below state level, dates other than year, phone numbers, email, record numbers, full-face photos, and the rest of the HIPAA "safe harbor" list) are removed, or an expert certifies a very small re-identification risk. CMIA "medical information" is similar: individually identifiable information about a patient's history, condition, or treatment.

The CMIA default: no disclosure without authorization

Civil Code § 56.10(a) says a provider "shall not disclose" medical information without an authorization unless subdivision (b) compels it or subdivision (c) permits it.

A valid authorization under Civil Code § 56.11 must be handwritten or typed in at least 14-point type, set apart from other language, and signed and dated by the patient or legal representative. It must describe the information covered, who may disclose it, who may receive it, the permitted uses, and a specific end date, and it must tell the signer they may have a copy.

Applying the rules to the knowledge statements

HIV status (K1011)

HIV test results get extra protection. Health and Safety Code § 120980 penalizes disclosing an identifiable HIV result to any third party without written authorization:

• Negligent disclosure: civil penalty up to $2,500 plus court costs, paid to the patient.
• Willful or malicious disclosure: $5,000 to $10,000 plus costs.
• Any disclosure that causes economic, bodily, or psychological harm: a misdemeanor, up to one year in jail and/or a fine up to $25,000.

Each disclosure is a separate offense, and written authorization is needed for each disclosure and must name the recipient. § 121010 lets you share results without written authorization with the patient or legal representative, with the patient's providers of health care, and with those providers' agents or employees who give direct patient care. Recording the result in the patient's own chart is not a disclosure (§ 120980(l)). The ADA Code adds an ethical caution in Advisory Opinion 1.B.2: when in doubt, get written permission before forwarding records with sensitive information such as HIV status.

Guardians and other personal representatives (K1012)

A personal representative stands in the patient's shoes: a parent or guardian of an unemancipated minor, a conservator, a health care agent under an advance directive, or an executor of a deceased patient's estate. For minors, the parent's right yields where the minor lawfully consented to the care (see Section 2.5 and Chapter 8). Family Code § 3025 says a parent may not be denied access to a child's medical or dental records because they are not the custodial parent.

People who pay the bill (K1013)

Civil Code § 56.1007 lets a provider share information "directly relevant" to a family member's or friend's involvement in the patient's care or payment, if the patient agrees, does not object when given the chance, or would not object in the provider's reasonable judgment. A spouse paying the invoice may learn the balance and the dates and procedure codes needed to pay it. That does not entitle them to the whole chart. If an adult patient says "don't discuss my treatment with my husband," honor it and bill the patient directly.

Collection agencies (K1014)

Under § 56.10(c)(3) and HIPAA's definition of "payment," you may give a collection agency the information needed to collect: name, contact details, dates of service, and the amount owed. Share the minimum necessary. Clinical notes, diagnoses, and radiographs are not needed to collect a debt. The agency must sign a business associate agreement and may not redisclose the information.

Audits (K1015)

Licensing and accrediting bodies may review records on the premises, but patient-identifying information may not be removed unless the law allows it (§ 56.10(c)(5)). B&P § 1611.5 lets the Dental Board inspect a dentist's books, records, and premises in response to a complaint. Refusing the inspection is itself grounds for suspension or revocation. Insurance carriers and Denti-Cal may audit claims as part of payment. HIPAA permits disclosures to health oversight agencies.

Subpoenas (K1016)

A subpoena duces tecum is compelled disclosure under § 56.10(b)(3), but it has built-in steps:

1. The subpoenaing party must serve the patient ("consumer") with a copy and a notice before the production date (Code of Civil Procedure § 1985.3), so the patient can object.
2. Unless you receive notice of an objection or a motion to quash, the custodian delivers copies with an affidavit in a sealed inner envelope within 15 days of receipt in a civil action or 5 days in a criminal action (Evidence Code §§ 1560–1561).
3. Under HIPAA 45 CFR § 164.512(e), a subpoena not signed by a judge requires "satisfactory assurance" that the patient was notified or that a qualified protective order was sought.

An attorney who brings the patient's signed authorization before any lawsuit is filed gets access under Evidence Code § 1158: the records must be available within five days, and copying charges are capped (10 cents a page for standard copies and $16 an hour for clerical time).