Patient Records Requests in a Dental Office

The HIPAA right-of-access rules for dental records and X-rays, with a free procedure and log. Last reviewed November 2026 against 45 CFR 164.524.

Patients' right to their own records is the HIPAA rule small dental practices most often get wrong, and the one behind most OCR dental cases, including the 2026 $140,000 solo-practice settlement. The rules are short. Here they are.

How long do you have?

• 30 calendar days from receiving the request to provide the records, or to deny in writing (45 CFR 164.524(b)(2)(i)).
• One extension of up to 30 more days, only if you send the patient a written notice within the first 30 days giving the reason and the date you'll act (164.524(b)(2)(ii)).
• Your state may set a shorter deadline. Follow whichever is stricter.
• Our recommendation: aim for 15 days, and log every request the day it arrives, including requests by email or phone.

What patients can get

Everything in the practice's "designated record set" about them (164.501, 164.524(a)): clinical notes, medical and dental history, periodontal charting, treatment plans, X-rays and intraoral photos, and billing records. They can inspect them, get a copy, or both.

• Form and format: provide the form the patient asks for if it's readily producible. If you keep the records electronically and the patient wants an electronic copy, provide one (164.524(c)(2)).
• A summary instead of the full record only if the patient agrees in advance, including to any fee for it.
• Sending to someone else: a patient can direct you, in a signed written request, to send a copy to another person, for example a new dentist (164.524(c)(3)(ii)). A 2020 federal court decision (Ciox Health v. Azar) narrowed how HHS applies this to third parties; the safe approach is to follow the patient's signed direction and charge no more than the patient rate.

What you can charge

Only a reasonable, cost-based fee covering (164.524(c)(4)):

• labor for copying (including converting to electronic form);
• supplies, such as paper or a USB drive the patient asked for;
• postage, if the patient asked for mailing;
• preparing a summary, if the patient agreed to one.

Nothing else is on the list: no search or retrieval fees, no per-page "processing" charges, and $0 is always allowed. Tell the patient the fee up front. Your state may also cap copy fees.

Can you say no?

Only on the limited grounds in the rule (164.524(a)(2)–(3)), for example psychotherapy notes, or a licensed professional's judgment that access is reasonably likely to endanger someone's life or physical safety. A denial must be in writing, in plain language, with the reason, the patient's review rights where they apply, and how to complain to you and to HHS (164.524(d)). An unpaid balance is not on the list of grounds: never hold records until a bill is paid.

Who can ask

The patient, or their personal representative: for example a parent of a minor or a legal guardian (164.502(g)). Verify identity and authority (164.514(h)), but don't make it hard: a patient you recognize, photo ID at the desk, or details matching the chart plus a call-back is usually enough. Don't require notarized letters or an in-person visit when a simpler check works.

Mistakes that lead to complaints

• Holding records until a balance is paid.
• Charging retrieval or per-page fees beyond actual copying costs.
• Ignoring a request because it came by email or wasn't on "our form".
• Sending X-rays only to the new dentist when the patient asked for their own copy.
• Missing the 30-day deadline without sending an extension notice.
• Not writing anything down, so there's no proof of when you responded.

What you need on paper

The rule requires you to document your designated record set and the titles of the people who receive and process access requests (164.524(e)), and to have written policies (164.530(i)). In practice that means:

1. a written access procedure the front desk follows;
2. a request log with dates received, deadlines and dates completed;
3. standard letters: acknowledgment, extension, fulfillment, denial;
4. a fee worksheet showing your fee is cost-based.

How long to keep dental records

HIPAA doesn't set how long you keep clinical records; your state dental board or state law does, and the rules differ (several states require six years or more, longer for minors). HIPAA does require you to keep your HIPAA documentation, including the access log and letters, for six years (164.530(j)).