Handle With Care: Protecting Patient Records Upon Sale of a Dental Practice
The care that dentists need to provide their patients doesn’t end when they get up from the chair. Dental offices, and the computers, networks, servers, and files maintained within (and outside of) their walls, contain patient files and information that must be kept protected from data breaches and unauthorized disclosure. Failure to handle these records properly can not only breach patient trust, but it can also create regulatory and licensing headaches for dentists and practice owners. That’s why ensuring that patient records are transferred securely and appropriately is of the utmost importance when a dental practice changes hands from one owner to the next.
When selling a dental practice, one of the most critical yet often overlooked aspects of the transaction involves the proper handling of patient records. As an attorney who has advised numerous healthcare providers through practice transitions, I can tell you that mishandling patient records can expose both the selling and buying dentists to significant legal liability, regulatory penalties, and damage to professional reputation. Understanding your obligations under federal and state law is essential to protecting yourself and your patients during this transition.
HIPAA Considerations Are the Highest Priority
Patient dental records are governed by both federal regulations, primarily the Health Insurance Portability and Accountability Act (HIPAA), and state-specific laws that vary considerably across jurisdictions. Under HIPAA, patient records are protected health information (PHI), and any transfer of a patient’s protected health information (PHI) must comply with the law’s strict privacy and security requirements. Additionally, most states have dental practice acts and regulations that impose specific recordkeeping and transfer obligations on licensed dentists. The downsides of failing to thoroughly and carefully follow these requirements arguably represent the biggest potential legal threat to buyers and sellers alike in a practice sale.
The selling dentist remains the legal custodian of patient records until the practice sale is complete and proper transfer protocols have been followed. This means that the practice owner cannot simply hand over file cabinets or hard drives to the buyer without taking appropriate legal steps. The seller’s fiduciary duty to their patients continues through the transition period and beyond.
Notifying Patients
Obviously, patients want and deserve to know that their dentist’s office is changing hands. While HIPAA does not explicitly require advance notice of a practice sale, it does require that patients be informed about who has access to their records. More importantly, many state laws explicitly require written notification to patients when a practice changes hands.
The seller should inform patients of the new practice owner's identity, the date of the transition, their options regarding their records, and how they can obtain copies of their records if they choose to seek care elsewhere. Typically, this notification should be sent 30 to 60 days prior to the sale closing, allowing patients sufficient time to make informed decisions about their care.
The Actual Transfer Itself
The purchase agreement should clearly specify how the records will be transferred, who will bear the costs of transfer, and in what format the records will be transferred. For electronic health records (EHRs), the seller may need to coordinate with their EHR vendor to ensure the proper migration of data to the buyer's system or to maintain access if the buyer intends to use the same platform.
For practices that still maintain paper records, the physical transfer must be handled securely to prevent unauthorized access or data breaches. Consider using a secure courier service and keeping a detailed inventory of all records transferred.
Record Retention Obligations
Generally, upon closing, the buyer assumes the responsibility for maintaining patient records going forward and must retain them for the period required by state law, which typically ranges from five to ten years from the last date of treatment. However, the seller may retain copies of records for their own protection, particularly if there's potential for future liability claims related to treatment provided before the sale.
For patients who choose not to continue with the new owner and who do not request their records be sent to another provider, the buyer typically assumes responsibility for storing these inactive records for the required retention period. The purchase agreement should clearly allocate these ongoing obligations and any associated costs.
Selling a dental practice is often the culmination of decades of hard work and the start of a new chapter in which the now-former practice owner can reap the benefits of those efforts. However, missteps in the handling of patient records could compromise those plans and leave the seller vulnerable to potential liability. By working closely with experienced counsel throughout the sales process, practice owners can wrap up their careers with clarity, confidence, and conclusiveness.
If you are a practice owner anticipating a sale or transition, please contact Grogan, Hesse & Uditsky today.
Contact Grogan, Hesse & Uditsky Today
If you are a practice owner anticipating a sale or transition, please contact Grogan, Hesse & Uditsky today. We focus a substantial part of our practice on providing exceptional legal services for dentists and dental practices, as well as orthodontists, periodontists, endodontists, pediatric dentists, and oral surgeons. We bring unique insights and deep commitment to protecting the interests of dental professionals and their practices and welcome the opportunity to work with you.
Jordan Uditsky, an accomplished businessman and seasoned attorney, combines his experience as a legal counselor and successful entrepreneur to advise dentists and other business owners in the Chicago area. Jordan grew up in a dental family, with his father, grandfather, and sister each owning their own dental practices, and this blend of legal, business, and personal experience provides Jordan with unique insight into his clients’ needs, concerns, and goals.
Speak to an Attorney
