Ep. 686 - Patient Owes You Money and Wants Their Dental Records: HIPAA Rules!

What happens when a loyal office manager tries to protect their doctor by withholding patient records until an outstanding bill is paid? As you'll discover in this episode, good intentions can lead to federal violations and costly consequences that no dental practice wants to face.

Dr. Karson Carpenter brings over 25 years of expertise in OSHA, HIPAA, and infection control compliance to dental practices nationwide. As a practicing dentist and President of Compliance Training Partners, he serves as an OSHA-approved trainer who has guided numerous clients through federal inspections and the critical post-inspection process. His extensive experience includes designing educational programs that bring dental, medical, and veterinary facilities into compliance with governmental regulations.

This episode examines a real-world HIPAA violation that started with a simple records request from a patient who owed money to the practice. Dr. Carpenter walks through the entire timeline — from the office manager's well-intentioned refusal to release records, to the patient's complaint to the Department of Health and Human Services Office of Civil Rights, to the extensive documentation requirements that followed. The discussion reveals how a single compliance misstep can trigger a comprehensive federal investigation that extends far beyond the original complaint.

Episode Highlights:

• Patient records must be released upon request regardless of outstanding balances, as federal HIPAA law classifies these records as patient property. Even diagnostic imaging obtained through promotional offers or unpaid services must be provided to patients when requested, despite the financial loss to the practice.
• HIPAA investigations are typically triggered by patient complaints rather than employee reports, and can be initiated through simple online searches that guide patients through the complaint process. The Department of Health and Human Services Office of Civil Rights provides detailed instructions and videos showing patients exactly how to file complaints and what penalties doctors may face.
• Federal data requests extend far beyond the original complaint and require comprehensive documentation including written HIPAA policies, annual training records with certificates of completion, and workforce training sign-in sheets. Practices without proper documentation face significantly more complex investigations and higher potential penalties.
• HIPAA fines typically range from $5,000 to $15,000 for standard violations, but the administrative burden of proving compliance often costs practices more in lost revenue and time than the actual monetary penalties. Practices that ignore complaints or fail to respond to administrative procedures can face six-figure fines.
• Preventive compliance requires documented annual HIPAA training for all staff members as part of the onboarding process, along with written privacy and security policies that address records release procedures. Practices with proper documentation can often resolve investigations quickly by providing requested materials to federal investigators.

Perfect for: Practice owners, office managers, and administrative staff who need to understand HIPAA compliance requirements and the serious consequences of improper records handling procedures.

Don't let a well-intentioned team member's mistake trigger a federal investigation that could have been easily prevented with proper training and policies.