DDSDoes HIPAA allow patient records to transfer in a sale?
Yes. HIPAA’s definition of health care operations includes the sale, transfer, merger or consolidation of a covered entity with another covered entity, and due diligence related to it. Transfers still need safeguards. Records duties are one part of the practice lifecycle, and counsel should review the details.
This page is general information, not legal advice. Have counsel review any sale agreement, and confirm requirements with the state dental board.
Who keeps the records after a sale?
It depends on deal structure and the contract. In an asset purchase, records often move to the buyer as custodian, while in a stock purchase they stay with the entity. The ADA suggests that the seller keep access to original charts and radiographs in all formats, because originals are stronger evidence than copies.
How long must patient records be kept?
State law sets dental record retention periods and they differ, so an owner should check the state board’s rule. The ADA suggests treating state rules as a minimum and considering 10 years after an adult patient’s last visit; HIPAA separately requires six years for required documentation such as policies. Counsel can confirm the rule.
What can patients still request after a sale or closure?
Patients keep their HIPAA right of access. A covered entity must act on a request no later than 30 days after receipt, with one extension of up to 30 more days if it gives a written reason. Fees, formats and custody after a closure are matters for counsel; see closing a dental practice.
Related guides: unplanned transitions, selling in a dental shortage area, the dental exit window.
HHS publishes guidance on patient access. Buyers treat records gaps as diligence items, and breach reports can appear as compliance signals in aggregate. See dental market data.
Frequently asked questions
How long must a dentist keep patient records?
It depends on state law. The ADA suggests considering 10 years after an adult patient’s last visit; ask counsel or the state board.
Who keeps patient records when a practice is sold?
Usually the buyer in an asset sale, with seller access rights, and the entity in a stock sale; the purchase agreement should say.
Can patients get their records after a sale?
Yes. HIPAA’s right of access continues, with a 30-day response deadline for a covered entity.
Do patients have to be notified of a sale?
State rules vary; confirm with counsel and the state dental board, and plan communication with patients and staff.
Sources
- U.S. Department of Health and Human Services (regulation text via Cornell Legal Information Institute). 45 CFR 164.524, Access of individuals to protected health information. law.cornell.edu.
- U.S. Department of Health and Human Services (regulation text via Cornell Legal Information Institute). 45 CFR 164.501, Definitions (health care operations). law.cornell.edu.
- U.S. Department of Health and Human Services (regulation text via Cornell Legal Information Institute). 45 CFR 164.530, Administrative requirements (documentation retention). law.cornell.edu.
- American Dental Association. What to do with patient records when selling a practice. ada.org.
- American Dental Association. Record destruction. ada.org.
Questions or corrections: request a correction. Markdown version: /lifecycle/patient-records-in-a-sale.md.