California Law and Ethics practice questions: Patient information

Answer C: Notify affected patients within 30 calendar days, and send the Attorney General a sample copy of the notice.

SB 446 amended Civil Code §1798.82 effective 1/1/2026 — patient notice no later than 30 calendar days after discovery, plus a sample notice to the Attorney General within 15 calendar days of notifying individuals when more than 500 California residents are affected.

Common trap: option A is the federal HIPAA clock (60 days) — California's stricter 30-day rule controls; option D confuses breach notice with the Board's separate 7-day adverse-event report.

Source: SB 446 amending California Civil Code §1798.82 — 30-calendar-day breach-notice deadline effective 1/1/2026; 15-day AG sample notice for breaches…

Answer A: At least 10 years from the date of service, audit completion, or contract end, whichever is later.

WIC §14124.1 requires Medi-Cal (Denti-Cal) provider records to be retained at least 10 years, using the applicable later trigger among service, audit completion, or contract end. HSC §123145's seven-year rule applies only when a provider licensed under HSC §§1205, 1253, 1575, or 1726 ceases operation; the Dental Board has said no general law sets one retention period for every dentist.

Common trap: do not convert a limited facility-closure statute into a universal private-dental-office rule.

Source: California Welfare & Institutions Code §14124.1 — 10-year minimum record retention for Medi-Cal (Denti-Cal) providers

Answer B: March 3, 2026 (within 30 calendar days of discovery).

Effective January 1, 2026, California Senate Bill 446 strictly requires entities to notify affected California residents of a data breach no later than 30 calendar days following discovery. This supersedes the federal HIPAA baseline.

Common trap: Choosing 60 days (the federal HIPAA standard), 15 days (which is the timeline for submitting a sample notification to the California Attorney General when a breach impacts more than 500 residents), or the old "without unreasonable delay" phrasing that SB 446 eliminated.

Source: SB 446 and Civ. Code section 1798.82 California breach-notice update to a 30-calendar-day deadline effective 1/1/2026

Answer C: Transmit the copies within 15 days, provided the patient pays a reasonable cost-based copying fee, regardless of the prior unpaid balance.

California law explicitly bans the "hostage rule." A health care provider is strictly prohibited from withholding patient records because of an unpaid bill for health care services.

Common trap: Believing the provider can hold radiographs or physical charts as leverage because the debt is directly related to the provided services, or assuming the dentist's ownership of the physical chart overrides the patient's right of access.

Source: HSC section 123110 patient inspection, copies, form/format, fees (including the §123110(j) per-page caps under SB 815), and unpaid-balance rule

Answer C: 21 years old.

When a provider licensed under one of the four HSC provisions listed in §123145 ceases operation, an unemancipated minor's record must be kept at least 1 year after age 18 and never less than 7 years after discharge. Seven years after the age-14 discharge is age 21, which is longer than age 19.

Common trap: Applying §123145 to every private dental practice. The provider's HSC §1205 license and cessation of operations are essential facts; the Dental Board has stated that no general law sets one retention period for all dentists. Medi-Cal records follow a separate program rule.

Source: HSC section 123145 — retention when a provider licensed under HSC §§1205, 1253, 1575, or 1726 ceases operation; not a universal private-dental-office…