HIPAA Rules for Referring Dental Patients

Somewhere between the operatory and the front desk, a great many dental practices acquired a rule that HIPAA never wrote: that a patient must sign a release before their records can go to a specialist. The form gets printed. The patient is no longer in the chair. Someone leaves a voicemail. A referral that could have gone out on Tuesday goes out the following week, and the only thing the delay protected was a misunderstanding.

What follows is a working account of what the HIPAA Privacy Rule actually permits when one dental provider refers a patient to another — written for the person who has to make the call at the desk, with links to the regulation itself so you can check every claim.

Treatment referrals do not need a signed authorisation

The Privacy Rule permits a covered entity to use or disclose protected health information for treatment, payment and health care operations without an authorisation from the patient. That is the plain text of 45 CFR 164.506¹, and treatment is the first item on the list. HHS says the same thing in ordinary English in its guidance on permitted uses and disclosures for treatment².

There is a detail inside that section worth knowing, because it removes the objection you will hear next. The rule permits disclosure for the treatment activities of a health care provider — not only to another covered entity¹. A specialist who runs an all-cash practice and files nothing electronically may not be a covered entity at all, and you may still send them the referral. The recipient’s covered-entity status is not the gate.

So what is an authorisation actually for? For the disclosures the rule does not already permit: most marketing, sales of protected health information, psychotherapy notes, and disclosures to parties with no treatment, payment or operations role at all. None of that describes sending a periapical to the endodontist you refer to every month.

What you do owe the patient is notice, not permission. Covered entities must maintain and provide a Notice of Privacy Practices describing the uses and disclosures they make, including for treatment³. The notice is how a patient learns that referrals happen. It is not a per-referral consent, and it does not need to be re-signed each time you refer.

Minimum necessary, and the exception nobody expects

The minimum necessary standard requires a covered entity to make reasonable efforts to limit protected health information to the minimum needed for the purpose of a use, disclosure or request⁴. It is the rule most often quoted back at a dental office, usually by someone declining to release a radiograph.

It also carries an exception most practices have never read: minimum necessary does not apply to disclosures to, or requests by, a health care provider for treatment⁴. The HHS guidance on the minimum necessary requirement states the same exception⁵. Read it carefully, because it is easy to over-read in both directions.

1. 1What the exception does mean

   You are not required to construct a justification, a policy or a field-by-field defence for the clinical scope of a treatment disclosure. A treating provider who asks for the relevant history is not asking you to do something the rule forbids, and you are not obliged to second-guess their clinical judgement about what they need to see.

2. 2What it does not mean

   It is not a licence to make "export the whole chart" your default. The exception removes a regulatory obligation; it does not remove the clinical and security case for sending what is relevant. Every extra page is more protected health information in transit, more to mis-route, and more to notify about if it lands in the wrong place.

3. 3What still applies

   Minimum necessary continues to govern disclosures that are not for treatment — to a plan for payment, to a vendor, to anyone with an administrative interest — and it continues to govern your own internal access controls. Switching it off for referrals does not switch it off for everything else.

When a referral platform or fax vendor needs a BAA

A business associate is, broadly, a person or organisation that creates, receives, maintains or transmits protected health information on behalf of a covered entity in order to perform a covered function⁶. The definition addresses transmission directly: someone providing data transmission services for protected health information who requires routine access to that information is a business associate⁶.

That phrase — routine access — is the entire test for referral technology. A platform that stores your referrals, renders the radiographs, holds the specialist’s reply and lets your staff search all of it plainly requires routine access. It is a business associate, and you need a signed Business Associate Agreement in place before any protected health information reaches it.

The counterweight is the conduit exception, and it is narrower than vendors like to imply. HHS describes it as covering entities that merely transport information without accessing it other than randomly or infrequently — the postal service, a courier, and their electronic equivalents⁷. A service that stores your data is not a conduit, even if nobody there ever opens it.

• A referral platform that stores or routes protected health information — agreement required
• An internet fax service that receives, stores or forwards documents — agreement required
• A practice management, imaging or backup vendor with access to your data — agreement required
• A transcription, billing or IT support company that touches patient records — agreement required
• The specialist you refer to — no agreement; they receive the information as a provider treating the patient in their own right
• A courier carrying a sealed envelope, or a network provider merely carrying traffic — generally a conduit

The second-to-last item is the one practices get backwards most often. You do not need a Business Associate Agreement with the endodontist. They are not performing a function on your behalf; they are treating the patient on their own account, under their own obligations as a provider¹⁰.

The agreement itself is not a formality. The rule sets out what a business associate contract must contain — permitted uses, required safeguards, flow-down to subcontractors, reporting of security incidents and breaches, and what happens to the information when the relationship ends⁸. If a vendor’s BAA is a paragraph buried in their terms of service with no breach-reporting duty owed to you, it is not doing the job the rule expects of it.

Permitted methods, and the "HIPAA-compliant" label

The Privacy Rule does not publish a list of approved transmission channels. Electronic protected health information is governed instead by the Security Rule, which is deliberately technology-neutral: it requires a risk analysis and a set of administrative, physical and technical safeguards, and it marks some specifications — encryption among them — as addressable rather than required, meaning you must assess them and document your reasoning if you implement something else⁹.

That design has a consequence practices rarely internalise. HIPAA obligations attach to covered entities and business associates, not to software⁶¹⁰. There is no federal certification a product can hold, and no agency that issues one. "HIPAA-compliant" on a vendor’s home page is marketing language, not a credential — compliance is a property of how you configure, use and govern a tool, which is why the Security Rule puts the risk analysis on you rather than on them⁹.

The useful question is therefore not "is this vendor HIPAA-compliant?" but a handful of answerable ones:

• Will they sign a Business Associate Agreement that obliges them to report breaches to you?
• Is protected health information encrypted in transit and at rest, and can they describe how?
• Can you see who opened a referral, and when, without asking them?
• What happens to your data — and the audit trail — if you leave?
• Have you recorded this vendor and this data flow in your own risk analysis?

On the channels themselves: an encrypted portal or secure messaging is the low-friction default and the easiest to evidence. Fax remains permitted — the rule has not retired it — provided the number is confirmed before sending and the receiving machine is not sitting in a corridor patients walk down. Ordinary email deserves its own note: nothing forbids it, but unencrypted email crossing the open internet is a safeguard decision you should make deliberately and write down, rather than one you make by accident because it was the fastest button. How we answer these questions for this platform is set out on our HIPAA and security pages.

What a patient can request, and what actually applies

An accounting of disclosures

Patients have a right to receive an accounting of disclosures of their protected health information¹¹. It is one of the rights most often described to patients as "a list of everyone who has seen my chart", which is not what it is. The rule excludes disclosures made to carry out treatment, payment and health care operations from that accounting¹¹. Your referral to the oral surgeon does not appear on it.

That is a reason to keep a good internal referral log, not a reason to keep none. The accounting right is not the only mechanism by which you will one day be asked to reconstruct who received what — a misdirected fax will do it faster, and with a deadline attached.

Requests to restrict a disclosure

A patient may request that you restrict uses and disclosures for treatment, payment or operations. You are generally not required to agree — but if you do agree, you are bound by what you agreed to¹². There is one restriction the rule makes mandatory, and it is not about referrals: where the patient has paid out of pocket in full for an item or service, you must honour a request not to disclose that information to a health plan for payment or operations purposes¹².

So a patient asking you not to tell their insurer may be making a request you are obliged to honour. A patient asking you not to send radiographs to the specialist who is about to treat them is making a request you may decline — though the conversation worth having there is a clinical one about what the specialist needs in order to treat safely.

Separately, patients may request confidential communications by alternative means or at alternative locations, and reasonable requests must be accommodated¹². In referral terms that usually means: call the mobile rather than the home number, and do not leave a detailed voicemail. It is a small field on the referral form and a large source of complaints when it is skipped.

The tripwire: sending to the wrong recipient

If this article carries one operational warning, this is it. The way a dental practice most commonly finds itself in breach-notification territory is not an attacker. It is a fax to a transposed number, a portal message to the similarly-named practice on the other side of town, or an attachment that carried the previous patient’s radiograph along with it.

The rule defines a breach as the acquisition, access, use or disclosure of protected health information in a manner not permitted by the Privacy Rule which compromises its security or privacy — and, critically, such an impermissible disclosure is presumed to be a breach unless the covered entity demonstrates a low probability that the information has been compromised, through a risk assessment covering at least four factors¹³:

1. The nature and extent of the information involved, including the identifiers present and the likelihood of re-identification
2. Who the unauthorised recipient was, and whether they have obligations of their own to protect it
3. Whether the information was actually acquired or viewed
4. The extent to which the risk has been mitigated

The presumption is the part that changes behaviour. The burden sits on you to document why an impermissible disclosure was not a breach — nobody has to prove to you that it was. A fax that landed at another dental office which confirms in writing that it destroyed the pages produces a very different risk assessment from a fax to an unrecognised number that nobody answers. Both still need the assessment written down and kept.

The rule does carve out narrow exceptions: an unintentional acquisition by a workforce member acting in good faith and within the scope of their authority, an inadvertent disclosure between people authorised at the same entity, and a disclosure where you have a good-faith belief the recipient could not reasonably have retained the information¹³. "The receptionist across town said she shredded it" may support your risk assessment. It is not automatically one of those exceptions.

Where it is a breach, notification to the affected individual is required without unreasonable delay and no later than 60 calendar days after discovery¹⁴, with notification to HHS and — above a threshold number of affected individuals — to the media, on the timetable set out in the OCR breach notification guidance¹⁵.

Prevention is cheap by comparison, and it is almost entirely about confirming the recipient before you send rather than after.

1. 1Verify the practice, not just the name

   Names collide and offices relocate. Confirm the provider against an authoritative public record — the NPPES NPI Registry is free to search and is the source of record¹⁸. We walk through it in verifying a specialist’s NPI.

2. 2Confirm the destination on every send

   Read the fax number or portal recipient back against the referral record each time, and treat a stored number as something to re-verify when a practice merges, moves or changes ownership.

3. 3Send the record, not the folder

   Attachments picked from a long list are exactly where the wrong patient’s film gets in. Radiographs are part of the dental record¹⁷, and they carry identifiers on the image itself.

4. 4Write the misdirect procedure before you need it

   Who is told, who performs the four-factor assessment, where it is documented, and who decides on notification. Working that out during the incident is how the 60 days gets consumed.

HIPAA is a floor, not a ceiling

Everything above is federal. HIPAA does not preempt a state law that is more stringent than the Privacy Rule¹⁶, and states do impose additional consent, notice and breach requirements — sometimes on categories of record that turn up routinely in dentistry, such as records for minors or those touching substance use. A referral that is straightforwardly permitted at the federal level can still require something extra where you practise.

This is the point at which the honest answer is to ask someone licensed in your state. Your own counsel and your state dental association are the right sources for that question. This article is not.

The short version

• You do not need a signed authorisation to refer a patient to another provider for treatment.
• Minimum necessary does not apply to treatment disclosures — send what is clinically relevant anyway.
• Any vendor that stores, routes or has routine access to your protected health information needs a Business Associate Agreement. The specialist does not.
• No product holds a HIPAA certification. Ask instead about agreements, encryption, audit logs and exit.
• Treatment disclosures do not appear in an accounting of disclosures.
• You may usually decline a request to restrict a treatment disclosure; you may not decline the self-pay restriction against a health plan.
• A misdirected send is presumed to be a breach until your own documented risk assessment says otherwise.

Getting the referral out correctly is half the job. The other half is the report coming back, which is a workflow problem rather than a privacy one — we treat it separately in closing the referral loop.