What are California dental records and confidentiality rules?

High-yield California rules for this topic

Confidentiality baseline

Records are confidential by default — release them only with a valid patient authorization, under a treatment-payment-operations exception, or under a lawful mandate, and share no more than the purpose requires.^{1 2} Under CMIA (Civil Code §56.11), a valid authorization must be handwritten or in type no smaller than 14-point, separate from other language on the page, signed (electronic or handwritten both count since AB 1697 took effect January 1, 2024), and must state an expiration date or event, the information covered, who may disclose and receive it, and the specific uses — with a copy given to the patient.¹ HIPAA is only the federal floor: when California is stricter, the California rule controls the exam answer.^{1 2 3}

Memorize it: "Federal Floor, State Ceiling" — HIPAA sets the minimum, California controls when stricter; CMIA demands 14-point type and a separate signature — electronic or handwritten, either one counts.

California access timelines

California runs on fixed clocks, and an unpaid balance never justifies withholding records, summaries, or radiographs — no "hostage rule."⁴

• Inspect within 5 working days after the request and satisfactory verification; copies within 15 days after the request; neither ordinary request must be written. A provider-elected summary under HSC §123130 is due within 10 working days, extendable to 30 days only for an extraordinarily long record or a recent discharge from a licensed health facility.^{5 4 6}
• Original radiographs may go directly to another provider named in the written request within 15 days.⁴
• One free copy for public-benefit or immigration-relief claims on a 30-day timeline; otherwise fees cap at $0.25 per page (paper) or $0.50 per page (microfilm) under HSC §123110(j), as amended by SB 815 effective January 1, 2024.⁴

Memorize it: "5-15-10-30" — 5 working days to inspect, 15 days for copies, 10 working days for a summary, 30 days for the free public-benefit copy; paid copies cap at 25 cents a page (50 cents from microfilm).

Chart integrity

Fix chart errors only with a transparent, dated addendum — never by deleting, overwriting, or backdating — because altering a record with intent to deceive is severe unprofessional conduct under BPC §1680.⁷ An adult patient who believes the record is incomplete or incorrect may attach their own addendum of up to 250 words per disputed item, which must stay with the chart and travel with any future disclosure of the disputed portion.⁶ The provider bears no liability for what the patient writes in it.⁶

Memorize it: "The 250 Club" — 250-word patient addendum limit per disputed item; never delete, only append.

Closure and disposal retention

Do not memorize one retention rule for every dental office. HSC §123145's 7-year adult and 1-year-past-18 / never-under-7 minor periods apply only when one of the specifically listed HSC-licensed providers ceases operation.⁸ The Dental Board says California has no one general retention period for all dentists.⁹ WIC §14124.1 separately imposes a 10-year rule for Medi-Cal provider records using its later-of trigger.¹⁰ Other payer, contract, facility, and liability rules may require different or longer retention.

Memorize it: "Retention Depends on Provider + Program" — 123145 = listed facility on cessation; 14124.1 = Medi-Cal 10.

Breach notification (updated for 2026)

For breaches discovered on or after January 1, 2026, SB 446's rewrite of Civil Code §1798.82 requires notice to affected California residents no later than 30 calendar days after discovery — the old "without unreasonable delay" wording is a stale-prep trap.^{3 1} A breach affecting more than 500 California residents also requires a sample notice to the Attorney General within 15 calendar days of notifying the individuals.³ Federal HIPAA (45 CFR §164.404) allows up to 60 calendar days, but California's stricter 30-day clock controls for California residents.² Delay is permitted only when a law enforcement agency determines the notice would impede an active criminal investigation.²

Memorize it: "30 in CA, 60 in DC" — 30 calendar days for patient notice under California SB 446 (and 15 days for the AG), compared to 60 days under federal HIPAA.

Footnotes

1. B1 California Confidentiality of Medical Information Act (CMIA), Civil Code §56 et seq.; valid-authorization requirements; state breach law overlay. https://leginfo.legislature.ca.gov/faces/codesTOCSelected.xhtml?tocCode=CIV ↩ ↩² ↩³ ↩⁴

2. B2 HIPAA Privacy, Security, and Breach Notification Rules — 45 CFR Parts 160–164 (federal floor only; California controls when stricter). https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164 ↩ ↩² ↩³ ↩⁴

3. A48 SB 446 amending California Civil Code §1798.82 — 30-calendar-day breach-notice deadline effective 1/1/2026. https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB446 ↩ ↩² ↩³

4. A9 California Health & Safety Code §123110 — patient inspection, copies, form/format, fees, and unpaid-balance rule. https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=HSC&sectionNum=123110. ↩ ↩² ↩³ ↩⁴

5. A8 Dental Board of California consumer FAQs — practical records-access guidance recommending a written or emailed request. https://www.dbc.ca.gov/consumers/consumer_faqs.shtml ↩

6. A26 California Health & Safety Code §§123111 and 123130 — patient addendums (250 words) and provider's HSC §123130 record-summary option. https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=HSC&sectionNum=123111. ↩ ↩² ↩³

7. A15 California Business & Professions Code §§1680, 1684.1, 1684.5 — unprofessional conduct, Board records demands, daily civil penalties. https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC&sectionNum=1680. ↩

8. A10 California Health & Safety Code §123145 — limited record-preservation rule for specified HSC-licensed providers that cease operation. https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=HSC&sectionNum=123145. ↩

9. B11 Dental Board of California 2018 Sunset Review Report — no one general record-retention period for dentists. https://www.dbc.ca.gov/formspubs/sunset_report_2018vol1.pdf ↩

10. A67 California Welfare & Institutions Code §14124.1 — 10-year minimum record retention for Medi-Cal (Denti-Cal) providers. https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=WIC&sectionNum=14124.1. ↩