Transfer of Records When Buying or Selling a Practice

Most dentists are aware of the requirements to protect patients’ personal protected health information (PHI) as specified by the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Yet, it is still common for dentists who are buying or selling a practice to not realize that they can’t simply receive or hand over patient records. Many dentists are also not aware that individual states may have privacy regulations, some of which are more stringent than the national regulations.1

HIPAA allows for the exchange of PHI without a written authorization

between current and prior practitioners or contemporaneously treating practitioners (including practitioners

who are treating the patient at the same time, such as consultants). However, HIPAA does not permit a doctor who is selling a practice to transfer PHI to a purchasing practitioner without the patient’s written authorization. Although handing over the records to the purchasing practitioner might seem like the most expedient solution, it just isn’t permissible under HIPAA.

Theodore Passineau, JD, HRM, RPLU, CPHRM, FASHR

State statutes and administrative rules may further complicate the process. For instance, states can require practitioners to maintain patients’ records for specified periods, dating from the last date of treatment. Many states impose a seven-year or

THEODORE PASSINEAU, JD, HRM, RPLU,

CPHRM, FASHR

longer record maintenance requirement, and many impose separate — and often more rigorous — requirements for the retention of pediatric records. HIPAA does not diminish the authority of these laws.2

records storage company. While these companies’ fees may be substantial, they offer several advantages. First, they will pick up the records and store them in a climate-controlled facility, which can protect them from environmental damage (e.g., dampness, mold, vermin, etc.). Second, these companies are usually bonded or insured, thereby reducing a dentist’s exposure if stored records are damaged, destroyed, or stolen while in the records storage company’s possession.

To comply with these records retention requirements, most retiring practitioners choose one of two options. First, they may store the records themselves. Many dentists retiring today do not have their records in electronic formats. When this is the case, the dentist who sells a practice often assumes responsibility for storing the paper records. In addition to the space requirements, this approach can be problematic if the records have not been maintained in an ordered system and a former patient requests a copy of the records (to which they are entitled under HIPAA).3

A third benefit to records storage services is their ability to respond to patients’ requests for records. Patients can be referred directly to the storage service, which then will locate and copy the records and collect the fee from the patient. HIPAA allows a reasonable fee to be charged for location and copying.

A second document maintenance option is the contracted services of a

Finally, at the time of records transfer, a records storage company will execute a

legal document called a Business Associate Agreement (BAA) with the storing practitioner. This HIPAA-required document obliges the storage company to protect the confidentiality of PHI contained in the patient records to the same standard that the dentist must protect it. Through the BAA, the dentist and the patient are assured that the PHI will be secure.

Ted Passineau is a senior risk management consultant for Medical Protective, the nation’s oldest professional liability insurance company dedicated to the healthcare professions. For additional information, please contact Ted at theodore.passineau@medpro. com or visit the Medical Protective website at http://www.medpro.com.

Experience has shown that when a practice is sold, many (but not all) patients stay with that practice and continue their care with the purchasing practitioner. This potential for continuity is a convenience for patients and it also enhances the value of the practice. It would be ideal if patients’ records could be immediately accessible to the new dentist. One possible solution is for the purchasing dentist to become the custodian of the selling practitioner’s records through execution of a BAA.

1 For example, many state privacy laws end their jurisdiction at the time of the patient’s death; however, HIPAA does not. Following the death of a patient, the only person who can authorize the release of the PHI is usually the executor or personal representative of the deceased’s estate. If an estate does not exist, a court order may be required to authorize the release of the information.

In this case, in addition to compliance with HIPAA Privacy and Security regulations, the BAA should specify that the custodian will provide the selling practitioner with access to the physical record upon reasonable notice (such as two business days), and that the custodian will not release or dispose of any original records without the seller’s written authorization.

2 It is important for the practitioner to know exactly what the retention requirements are in his or her state of practice. This information can normally be acquired through the state dental society.

3 Under HIPAA, the practitioner’s responsibility to provide patients with copies of their records does not terminate with the practitioner’s retirement. As long as the practitioner still possesses the records, he or she must provide copies if patients request them.

As needed, patients who continue their relationship with the practice will be asked to provide written authorization to release the record from the seller to the purchaser. Once this release is authorized, the new dentist (who is in physical possession of the record) can utilize the record as they would with any other active patient. Records of patients who leave the practice would ultimately be placed in storage. This arrangement would be permissible under HIPAA.4

4 This article focuses on the practitioner who is still using a paper record system. If the practitioner has transitioned to an electronic health record (EHR) prior to selling the practice, then PHI transfer is less complicated. In such cases, the retiring practitioner would transfer all records electronically to the purchaser (in an encrypted format and, again, after executing a BAA). The purchasing practitioner would then, with the patient’s written authorization, transfer individual records to active files when needed. The records of patients who do not remain with the practice would be stored as an inactive/archived record. The selling practitioner could also easily retain a copy of all patient records for his or her future use.

Although it may seem onerous, HIPAA has been valuable in providing uniformity in administration and enhanced protection of patients’ PHI — an important consideration in this age of medical identity theft. With proper planning, continuity of patient care and compliance with HIPAA can be accomplished when a dental practice changes ownership. ■

Please reach out to our authors

and our advertisers. They care about you and keep us in print.

If you have any questions,

comments, or responses to our

magazine, please connect with us

on Dental Entrepreneur Magazine

— our official Facebook page!

Read us online

Send your questions or

comments to aduff2@aol.com