HIPAA Retention Ownership Charting

HIPAA Retention Ownership Charting

Quick Answer: Dental radiographs are part of the legal dental record. The practice typically retains ownership of original images while patients have a right to access copies; HIPAA governs privacy and release. Retain images per state dental-board and malpractice rules (often years beyond last visit), and chart findings with Universal numbering for permanent (1–32) and primary (A–T) teeth.

Technique skill means little if the record is incomplete, mislabeled, or released improperly. Outline I.D.10–11-style content ties mounting and orientation to documentation, ownership, retention, and privacy—the administrative half of radiographic competence.

What Counts as the Radiographic Record

The radiographic portion of the chart usually includes:

• Image files (intraoral, panoramic, cephalometric, CBCT volumes when acquired)
• Acquisition metadata (date, operator, and stored exposure settings)
• Interpretation/findings entered by the dentist (assistants may expose and mount; diagnosis is dentist-driven per state law)
• Consent notes when required for radiographic exposure
• Release forms when copies go to another provider or to the patient

Digital images must remain readable for the retention period. That implies backup, migration when software vendors change, and a reliable export path. "We can see it on the old computer in the basement" is not a retention plan.

Ownership vs Access

A high-yield distinction:

• Ownership of the original record generally rests with the dentist/practice that created it. Original sensors, PSP plates, and server files are not the patient's personal property to remove without process.
• Patient access rights (under HIPAA and many state laws) mean the patient can request copies or an electronic transmission within required timeframes, after identity verification and, when permitted, reasonable cost-based copy fees—not barriers designed to withhold care.

When a patient transfers offices, send copies or an export to the new provider with proper authorization. Follow current office policy aligned with state and HIPAA rules on whether unpaid balances can delay record transfer.

HIPAA Privacy Essentials for Radiography

HIPAA's Privacy Rule treats radiographs as protected health information (PHI) when linked to identifiers. Practical controls:

• Do not display identifiable images on screens visible to other patients.
• Use unique logins; do not share acquisition-software passwords.
• Prefer secure patient portals or practice-approved encrypted methods—not personal webmail—when transmitting images.
• Apply the minimum necessary standard: send what the referral needs, not the entire lifetime archive by default.
• Keep business associate agreements in place with cloud backup and IT vendors that store image data.

Common breach scenarios include lost unencrypted USB exports of an FMX and chart screenshots posted to social media. Prevention is part of the radiographer's duty even when the dentist leads the covered entity.

Retention: How Long to Keep Images

HIPAA sets privacy rules; retention length for dental radiographs is driven mainly by:

• State dental practice acts / board rules
• Statute of limitations for malpractice (often longer for minors—retain until majority plus the limitation period in many jurisdictions)
• Payer and clinic policies

Many practices keep adult records at least 6–7 years after the last date of service and keep pediatric records longer; some keep radiographs indefinitely when storage allows. For RHS, memorize the principle: follow state law and office policy, retain long enough to defend care, and never discard images still inside the required window. When in doubt, archive rather than purge.

Charting with Universal Numbering

Correct orientation feeds correct charting. Use the Universal Numbering System:

Permanent dentition (1–32)

• 1 = maxillary right third molar
• 16 = maxillary left third molar
• 17 = mandibular left third molar
• 32 = mandibular right third molar
• Maxillary teeth run 1 → 16 (patient's right → left)
• Mandibular teeth run 17 → 32 (patient's left → right)

Primary dentition (A–T)

• A = maxillary right second molar
• J = maxillary left second molar
• K = mandibular left second molar
• T = mandibular right second molar
• Letters proceed across the maxilla A→J, then mandible K→T

Mixed dentition may show permanent numbers and primary letters together (for example, erupting #19 beside primary L). If it is a primary tooth, use a letter—never invent a hybrid label.

Linking Mount Orientation to the Odontogram

Example workflow after a right-side bitewing:

1. Confirm labial mounting (patient's right on viewer's left).
2. Identify the bright amalgam on the viewer's left first molar position.
3. Chart the finding on tooth #3 (permanent maxillary right first molar), not #14.
4. Initial and date the entry per office protocol.

A reversed mount turns that same amalgam into a false left-side entry—creating a chart that disagrees with reality and with future providers.

Releases, Referrals, and Role Boundaries

Document who requested the images, what was sent (FMX/panoramic with dates), the method (portal, encrypted email, diagnostic-quality copies), and authorization when required. CBCT volumes remain PHI and need the same privacy controls as intraoral files; exports should be diagnostically usable, not tiny screenshots.

Radiography-certified assistants expose, scan, mount/orient, and may enter technical notes. Diagnostic interpretation belongs to the dentist in most jurisdictions. Record technical limitations honestly ("gagging limited sensor placement; #17 apex not fully imaged") so the dentist's entry is informed.

HIPAA, retention, ownership, and Universal charting close the Outline I.D. loop: an image that is correctly exposed but wrongly sided, unlawfully shared, or prematurely deleted fails the standard of care as surely as a cone cut.