# California RDH Law & Ethics Exam Area 1B: Patient Privacy and PHI What Area 1B of the California RDH Law and Ethics exam tests: HIPAA, California confidentiality law, records access and PHI handling. Area 1B · 9% of the California RDH Law & Ethics exam. Last updated 2026-09-24. Patient privacy and protected health information make up 9% of the 2025 outline (the exam has 60 questions, 50 scored, in 90 minutes). This area tests your understanding of the strict state laws that sit on top of the federal baseline, dictating how you handle patient records, respond to access requests, and deliver care through telehealth. It matters because California holds you personally accountable for patient confidentiality, and the exam expects you to know exactly which rule controls when state and federal deadlines collide. ## At a glance | Detail | What the sources establish | | :--- | :--- | | **Exam weight** | This subarea is 9% of the 2025 outline (the exam has 60 questions, 50 scored, in 90 minutes), testing tasks T5 through T8. [^B1] | | **Confidentiality** | California law requires a valid authorization, a legal mandate, or a permitted purpose to release records. [^A44] | | **Record access** | Providers must allow inspection within 5 working days and send copies within 15 days of the request; records can never be withheld over an unpaid bill. [^A46] | | **Breach notice** | California requires individual notice within 30 calendar days of discovery or notification of the breach. [^A45] | | **Telehealth** | Telehealth is a delivery mode that requires documented patient consent before care begins; it does not expand your scope of practice. [^A41] | ## What the exam expects you to know ### T5 — Maintain patient confidentiality Everything a patient tells you, and everything the chart says about them, is confidential by default. Your responsibility is to keep it that way unless a specific legal door opens. The working rule in California is the Confidentiality of Medical Information Act (CMIA), which prohibits a health care provider from disclosing medical information without first obtaining an authorization, except for specific mandatory and permissive disclosures. [^A44] This duty follows the information and the licensee, not just the practice owner. A hygienist who discusses a patient's diagnosis in the break room has breached confidentiality. [^A44] CMIA structures the release of information into three distinct lanes. The first is a valid patient authorization. The second lane covers mandatory disclosures, where CMIA compels release in listed situations, such as responding to a court order or a qualifying subpoena. [^A44] The third lane covers permissive disclosures, allowing you to share information for diagnosis or treatment, payment to the extent necessary, and billing or administrative-service providers without a separate authorization. [^A44] When you release information, you must keep the disclosure tied to the lane that authorized it. A payment disclosure carries only billing information, and a subpoena response carries only what the subpoena covers. [^A44] ### T6 — Comply with record requests and protect patient rights When the right person asks for a patient record the right way, California puts you on fixed clocks. Under the Health and Safety Code, adult patients, minors who lawfully consented to their own care, and their legal personal representatives have an enforceable right to see and copy their treatment records. [^A46] The deadlines are strict. The patient must be allowed to inspect the records within 5 working days after the request is received. Reasonable identity verification is allowed but may not be used to delay compliance. [^A46] If the patient requests copies, those copies must be transmitted within 15 days. [^A46] A summary may be provided, and charged for, if the patient agrees. [^A46] If the patient needs records to support a claim for a listed public benefit program, one relevant copy must be provided free of charge on a 30-day timeline. [^A46] Fees for copies are cost-based rather than a flat price list. The provider may charge a reasonable fee built only from specific components: the labor of copying the record, supplies for paper copies or electronic media, postage, and an agreed-upon summary. [^A46] The statute caps paper copies at $0.25 per page and microfilm at $0.50 per page. [^A46] These ceilings are medium-specific and do not cap the labor of making an electronic copy, which remains reasonable, cost-based. [^A46] For radiographs, the office may satisfy an access request by transmitting the X-rays directly to another health care provider named in the patient's written request within the 15-day window, charging the actual reasonable cost of transmission. [^A46] The most absolute rule in this section is the prohibition on holding records hostage. An unpaid balance never justifies withholding records or summaries. [^A46] Debt collection and record access run on completely separate tracks. When releasing records to third parties, you must verify the lane. Releasing records to another treating provider is a permissive CMIA disclosure for diagnosis or treatment. [^A44] On the federal side, this transfer is an express exclusion from the minimum necessary standard, meaning you send the complete clinical information the receiving provider needs rather than trimming it down. [^A68] Conversely, releasing records to a biller or collection agent rides the payment lane, where the minimum necessary standard does apply, so it carries only the required billing information. [^A44][^A68] ### T7 — Comply with HIPAA and state privacy laws The federal Health Insurance Portability and Accountability Act (HIPAA) serves as the national floor for privacy and security. It protects individually identifiable health information held or transmitted by a covered entity in any form. [^A68] The Privacy Rule permits use and disclosure without authorization for treatment, payment, and health care operations, and it reaches protected health information in every medium, including paper charts and spoken conversations. [^A68] The Security Rule is narrower, applying its administrative, physical, and technical safeguards only to electronic protected health information. [^A68] California's 5-working-day and 15-day access clocks are the binding standard for a California practice. [^A46] Since January 1, 2026 (SB 446), California requires notice within 30 calendar days of discovery or notification of the breach. [^A45] This 30-day duty permits delay only in two narrow circumstances: to accommodate the legitimate needs of law enforcement when an agency determines that notification will impede a criminal investigation, or as necessary to determine the scope of the breach and restore the reasonable integrity of the data system. [^A45] When a breach affects more than 500 California residents, a sample copy of the notice must be submitted to the California Attorney General within 15 calendar days after the affected consumers are notified. [^A45] ### T8 — Comply with telehealth laws Telehealth is a delivery method, not a separate license. The same scope of practice, supervision levels, and privacy rules apply as if the patient were sitting in your chair. California law defines telehealth as delivering health care services via information and communication technologies while the patient is at an originating site and the provider is at a distant site. [^A41] The statute expressly states that telehealth does not alter the scope of practice of any health care provider or authorize the delivery of services in a setting not otherwise authorized by law. [^A41] Before delivering care via telehealth, the provider initiating the service must obtain the patient's verbal or written consent to telehealth as an acceptable mode of delivery, and that consent must be documented. [^A41] For a hygienist, the specific telehealth authorization involves radiograph determination and interim therapeutic restorations. These duties may be performed in a dental office setting or in a public health setting using telehealth for the purpose of communicating with the supervising dentist. [^A11] In a store-and-forward model, the hygienist gathers diagnostic information and transmits it to the dentist. The dentist reviews the images and makes the diagnosis and treatment plan. An interim therapeutic restoration may only be placed after the diagnosis, treatment plan, and instruction to perform the procedure are provided by a dentist. [^A11] A dentist may not concurrently supervise more than five RDAEFs, RDHs or RDHAPs performing these §1910.5-type duties (§1684.5(d)). [^A43] ## Common traps * **Applying a 60-day breach window** → Where the California duty applies and no statutory delay lane is open, California's 30-calendar-day individual notice deadline controls. [^A45] * **Withholding records over an unpaid balance** → California law flatly prohibits withholding records or summaries because of an unpaid bill for health care services. [^A46] * **Applying the minimum necessary standard to a treatment transfer** → Federal law expressly excludes disclosures to a health care provider for treatment from the minimum necessary standard. [^A68] * **Assuming the Security Rule covers paper charts** → The Security Rule's safeguards protect electronic information only; the Privacy Rule is the doctrine that spans every medium. [^A68] * **Believing telehealth expands what an RDH may do** → Telehealth changes the delivery mode only, and interim therapeutic restorations still require a dentist's diagnosis and instruction before placement. [^A41][^A11] ## Check yourself Answer the original practice item, then take the free 15-question practice test to see every area. ## How to study this area Patient privacy makes up 9% of the 2025 outline (the exam has 60 questions, 50 scored, in 90 minutes), and it covers both state and federal privacy law. Your study time should focus on memorizing the exact deadlines and the specific formats California requires. When reviewing this subarea, anchor your understanding to the fixed numbers. You need to recognize immediately when a scenario presents a state rule that overrides a federal baseline. 1. Drill the access clocks until they are automatic: 5 working days to inspect, 15 days for copies, and 30 days for a public benefit copy. 2. Memorize the breach deadlines: 30 calendar days to the individual, subject to narrow delay lanes, and 15 calendar days to the Attorney General after consumers are notified if the breach affects more than 500 Californians. 3. Master the three doors of the Confidentiality of Medical Information Act. 4. Anchor telehealth to your scope limits, remembering that the technology moves the images but never moves the diagnosis into your hands. ## Questions candidates ask ### Can I charge a patient for electronic record copies? Yes, but the fee must be reasonable and cost-based. While California law caps paper copies at $0.25 per page, it sets no per-page ceiling on the labor of making an electronic copy, which remains reasonable, cost-based. [^A46] ### Does a patient need to sign a HIPAA form to transfer records to a new dentist? No. Disclosing records to another health care provider for diagnosis or treatment is a permitted lane under the Confidentiality of Medical Information Act. [^A44] This provider-to-provider transfer is also expressly excluded from the federal minimum necessary standard. [^A68] ### Can I place an ITR through telehealth before the dentist sees the images? No. Under California law, an interim therapeutic restoration may only be placed after the supervising dentist provides the diagnosis, treatment plan, and instruction to perform the procedure. [^A11] [^A11]: Cal. Bus. & Prof. Code § 1910.5 — Additional Authorized Duties — Additional duties. [Cal. Bus. & Prof. Code § 1910.5](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1910.5.&lawCode=BPC) [^A41]: Cal. Bus. & Prof. Code § 2290.5 — Telehealth — Telehealth definitions. [Cal. Bus. & Prof. Code § 2290.5](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=2290.5.&lawCode=BPC) [^A43]: Cal. Bus. & Prof. Code § 1684.5 — Patient of Record; Supervision Limits — Patient-of-record requirement and diagnostic-purpose exceptions for auxiliaries. [Cal. Bus. & Prof. Code § 1684.5](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1684.5.&lawCode=BPC) [^A44]: Cal. Civ. Code § 56.10 et seq. — Confidentiality of Medical Information Act — Confidentiality of Medical Information Act. [Cal. Civ. Code § 56.10 et seq](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=56.10.&lawCode=CIV) [^A45]: Cal. Civ. Code § 1798.82 — Breach Notification — Security-breach notification for computerized personal data, as amended by SB 446 (Stats. 2025, eff. 2026-01-01). [Cal. Civ. Code § 1798.82](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.82.&lawCode=CIV) [^A46]: Cal. Health & Safety Code § 123110 et seq. — Patient Access to Health Records — Patient access to health records. [Cal. Health & Safety Code § 123110 et seq](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=123110.&lawCode=HSC) [^A68]: 45 CFR Parts 160 and 164 (HHS HIPAA Privacy Rule) — HIPAA Privacy and Security Rules. [45 CFR Parts 160 and 164](https://www.hhs.gov/hipaa/for-professionals/privacy/index.html) [^B1]: PSI Services LLC / DHBC, *Registered Dental Hygienist (RDH) Laws and Ethics Written Examination — Candidate Information Bulletin*, January 2026 edition — RDH exam logistics and blueprint. [PSI Services LLC / DHBC, *Registered Dental Hygienist](https://www.dhbc.ca.gov/formspubs/candidate_handbook.pdf) ## Next step [Take the free 15-question practice test](/rdh/free-practice-test): every outline subarea, graded answers with reasons, and an area-by-area result. Price: $99 once, or $89 after you finish the free practice test. 180 days of access. [See what the full prep includes](/products/california-rdh-law-ethics). Independent exam preparation. No Board endorsement or pass guarantee. Independent educational preparation, not legal advice, and not affiliated with or endorsed by the Dental Hygiene Board of California or PSI. Confirm current requirements with the Dental Hygiene Board of California.