A Record-Request Case Study

for prior treatment rendered by him. The office sent the check to the patient; however, the patient did not cash the check.

The call: A dentist called for advice regarding handling a records request from a patient’s spouse.

The patient had originally presented for extraction of tooth No. 32. After the administration of local anesthesia, the patient started to complain about breathing issues and shaking. The office immediately called 911, and the patient was transported to the nearest emergency room.

Later that evening, the office learned from the patient’s wife that he suffered a mini-stroke and would be in the hospital for a few days.

Over the next few weeks, the office made several attempts to reach out to the patient and follow up. "The patient did not respond to any of the calls and eventually sent a text message stating, I can't speak with you any longer." The dentist was concerned to receive this message from the patient. He assumed that the patient’s condition may have been his fault and that perhaps he could have handled things differently at the time the patient presented for the extraction. To help remedy the situation, the dentist decided to refund the patient

Three months later, the office received a request for the patient’s records from his spouse. Considering the patient’s concerning history, the dentist reached out to TDIC for direction.

The advice: Any time a request for records comes from someone other than the patient, Risk Management analysts advise caution. In this situation, the analyst suggested that the dentist first check the patient’s records to see if the patient had signed a form authorizing the release of records to his spouse. If an authorization was on file, then the dentist should respond to the request for records without delay.

The analyst advised the dentist that to ensure adherence to both state and federal regulations pertaining to HIPAA and privacy laws, in the absence of a written authorization from the patient, the office should not release the records to the patient’s spouse. Additionally, the analyst advised the dentist of his obligation to comply with an authorized records request and the patient’s (or their representative’s) rights to having access to a copy of the record.

Protect Personal Health Information

Health care professionals have a legal and ethical obligation to protect the privacy of patients' personal health information (PHI). In turn, patients have the right to access their own medical records, including their dental records, under certain circumstances.

The first step is to ensure all adult patients sign a form authorizing the release of dental records and to keep a copy of the signed form in the patient’s chart. TDIC offers a downloadable sample authorization form. Patients can, and have, taken legal action against dentists who, for whatever reason, fail to produce records when requested. As legal documents, these records can be subpoenaed in legal cases and must be produced by the date indicated in the subpoena.

Subpoenaed records requested through the subpoena process isn't the only method that requires a practice to release a patient's records. Patients also have a right to their own records, and dentists are obligated to produce them within a certain period after receiving a written request. For example, the state of California’s Health and Safety Code states that dentists have 15 days (about two weeks) to comply with such requests and must provide the records in full. Additionally, California Evidence Code states that if a patient’s legal representative submits a written request for records, the medical provider must make them available for inspection within five business days.

Health care

Releasing Records to Family Members or Third Parties

When it comes to releasing dental records for adult patients, be cautious and follow the guidelines outlined by HIPAA and your state's specific guidelines. If a family member requests dental records for an adult patient, the dental practice must first verify the identity of the requester and determine if they are authorized to receive the information.

If the adult patient is not present to provide authorization to access records, HIPAA guidance states that a provider may release the records to a family member if: continued from page 9

• The patient has provided written authorization for the release of their PHI to the family member.

• The patient has designated the family member as their personal representative for health care decision-making purposes.

• The family member has legal authority to act on behalf of the patient, such as a court-appointed guardian or power of attorney.

• If none of these conditions are met, the dental practice may be prohibited from releasing the patient's PHI to the family member, even if the patient is deceased.

Dental practices should also be cautious about releasing PHI to thirdparty requesters, such as insurance companies or attorneys, without the patient's authorization. HIPAA requires that health care providers obtain written authorization from the patient before disclosing their PHI to third-party requesters. Failure to obtain proper authorization can result in significant penalties and fines.

While dental offices may be allowed to charge a fee for providing records, Advice Line analysts caution using discretion when doing so. In many situations, requesting a fee to access records may not be a good idea, since it will inflame any existing tension. It is also important to note that access to patient records may not be withheld due to an unpaid balance.

Reporting to the Dental Board

This particular Advice Line call also highlights another aspect of patient records: reporting adverse occurrences to the state dental board. Because the patient in question had required emergency care during a dental procedure, that information needed to be reported to the dental board. Providing the dental board with PHI related to the adverse occurrence is not a HIPAA violation.

According to TDIC’s Advice Line analysts, most state dental boards require licensees to report any adverse occurrences or events possibly related to dental treatment to their state licensing board. This includes the death of a patient following treatment. Failure to submit a report to the state licensing agency can result in discipline against a dentist’s license and potentially a finding of unprofessional conduct. Advice Line analysts suggest that if there is any question of whether an incident should be reported, it is best to file a report out of an abundance of caution.

Due to the profound consequences of failing to properly report adverse occurrences, TDIC strongly advises dentists to contact the Advice Line as soon as possible following an in-office emergency or death of a patient. (In some states, the period for reporting can be as soon as 48 hours after the event.) Knowledgeable analysts will guide you through the appropriate steps of timely board reporting and will provide the necessary referral to an attorney versed in handling board matters.

When reporting the death of a patient, state dental boards generally require the following information:

• Dentist’s name and license number.

• Contact information (email, phone number and address).

• Date and time of the occurrence.

• Facility where occurrence took place.

• Name of patient, gender and medical history.

• Dental procedure involved and the duration of treatment prior to the incident.

• Type and dosage of all drugs and medications used in the procedure.

• A description of the occurrence and interventions.

• The condition of the patient pre-op and post-op.

TDIC offers a helpful reference guide specifically for reporting adverse events, the Adverse Occurrence Guide Policyholders can log in to their TDIC online account to access this tool and other helpful resources to prepare for, prevent and respond to potential risks.

Balancing Privacy and Access

Patient-record access is a complex issue that requires dental practices to balance the patient's right to access their medical records with the need to protect their privacy and confidentiality. Establish office protocols for records release and train your staff to proceed with caution when releasing PHI to ensure that proper authorization is obtained before disclosing any information. If a family member requests dental records for an adult patient, carefully verify the identity of the requester and determine if they are authorized to receive the information.

Disgruntled Patients

When an angry patient manifests their feelings into threatening behavior such as yelling, cursing, stalking or even violence, practice owners must intervene. As employers, they are obligated to provide a safe working environment for their staff, one in which employees are not fearful for their own safety. Caution should be taken to address threats to the well-being of staff and patients just as seriously as threats to the practice owner.

TDIC’s Advice Line has received an increasing number of calls about patients who are overly aggressive or display unreasonable anger toward dental providers and staff.

A Disgruntled-Patient Case Study

reminded her that they had terminated her care, the patient became belligerent and hung up the phone saying, “I’ll see you in court.”

Uncertain and fearful as to what to expect next, the office reached out to the Advice Line.

The call: The Advice Line received a phone call from a dentist in reference to managing an unhappy patient. This patient had a history of being difficult to deal with and generally unpleasant. After completing a root canal, the dentist reminded the patient of the additional steps needed to complete treatment on the tooth. The dentist believed that the patient already understood that the tooth would require a crown following the root canal, as he had other teeth that had undergone root canal therapy.

Upon learning about the need for additional treatment, the patient became verbally and physically threatening toward the dentist and her team. Staff members repeatedly asked the patient to leave, but she refused. The patient eventually left but loudly voiced her displeasure with profane statements.

After enduring several negative encounters with the patient, this was the final straw. The dentist decided to terminate the doctor-patient relationship. Two weeks after the dismissal letter was mailed, the patient called the office, demanding an appointment. When the office continued from page 13

The advice: The analyst agreed with the dentist’s decision for termination of care, particularly because of the patient’s abusive and threatening language and behavior. The analyst reminded the dentist of her obligation as an employer to provide a safe environment for staff, free of harassment and hostility. Because of this, the analyst advised the dentist that in this situation, regardless of the patient being mid-treatment, dismissal was the best approach.

De-escalation and Mitigation

Some key communication strategies are important when dealing with angry or aggressive patients.

• Set boundaries. Have clear expectations of behavior for both patients and staff, along with planned responses for when anyone crosses those boundaries.

• Remain calm. Always respond with a professional demeanor.

• Be understanding and empathetic. Listening is an essential element of communication. Let upset patients know you are willing to hear them out. “Sometimes patients just want to be heard,” Senior Risk Management Analyst Taiba Solaiman explains. “Sit down with them privately and let them know you understand they are upset and that you are willing to listen to their concerns. A compassionate ear can go a long way in diffusing a tense situation.”

• Remember documentation. Just as you make careful notes regarding treatment in a patient’s chart, you should document any conflicts that arise with a patient. Document these interactions in an area separate from the clinical notes such as a journal or side note area.

• Know when to contact law enforcement. It may not be necessary to contact police when a patient is upset or confrontational. However, if a patient refuses to leave the office when asked to do so or engages in behavior including — but not limited to — harassing staff by calling repeatedly, making threats to show up at the office and do harm or physically interacting with anyone in the office, it is appropriate to call the police to intervene. (If you are not in immediate danger, it is advisable to seek guidance from the Advice Line when these situations arise.)

On the rare occasion anger escalates to aggression, be aware of your obligation to provide a safe working environment for your employees. Also be mindful of the anxiety you and your employees may experience after a traumatic event and provide supportive resources. Request law enforcement to help de-escalate the situation when needed and seek expert support from TDIC analysts to help with properly dismissing a patient from care.