# What are California dental records and confidentiality rules? > Use this guide when you need the California timelines and confidentiality rules that show up repeatedly on the Dental Law & Ethics exam. Last verified: 2026-06-09 Reviewed by: Mahtab Mansour, DDS on 2026-04-25 (re-verification in progress) ## Direct answer - Inspection is due within 5 working days and copies are due within 15 days after a written request. - Unpaid balances do not justify withholding records, radiographs, summaries, or other lawful disclosures. - Correct charts with transparent addenda instead of deletion, overwriting, or backdating. ## Full guide ## High-yield California rules for this topic ### Confidentiality baseline Records are confidential by default — release them only with a valid patient authorization, under a treatment-payment-operations exception, or under a lawful mandate, and share no more than the purpose requires.[^B1] [^B2] Under CMIA (Civil Code §56.11), a valid authorization must be handwritten or in type no smaller than 14-point, separate from other language on the page, signed (electronic or handwritten both count since AB 1697 took effect January 1, 2024), and must state an expiration date or event, the information covered, who may disclose and receive it, and the specific uses — with a copy given to the patient.[^B1] HIPAA is only the federal floor: when California is stricter, the California rule controls the exam answer.[^B1] [^B2] [^A48] **Memorize it:** **"Federal Floor, State Ceiling"** — HIPAA sets the minimum, California controls when stricter; CMIA demands 14-point type and a separate signature — electronic or handwritten, either one counts. ### California access timelines California runs on fixed clocks, and an unpaid balance never justifies withholding records, summaries, or radiographs — no "hostage rule."[^A9] - Inspect within `5 working days`; copies within `15 days`; a provider-elected summary under HSC §123130 within `10 working days`, extendable to `30 days` only for an extraordinarily long record or a recent discharge from a licensed health facility.[^A9] [^A26] - Original radiographs may go directly to another provider named in the written request within `15 days`.[^A9] - One free copy for public-benefit or immigration-relief claims on a `30-day` timeline; otherwise fees cap at `$0.25` per page (paper) or `$0.50` per page (microfilm) under HSC §123110(j), as amended by SB 815 effective January 1, 2024.[^A9] **Memorize it:** **"5-15-10-30"** — 5 working days to inspect, 15 days for copies, 10 working days for a summary, 30 days for the free public-benefit copy; paid copies cap at 25 cents a page (50 cents from microfilm). ### Chart integrity Fix chart errors only with a transparent, dated addendum — never by deleting, overwriting, or backdating — because altering a record with intent to deceive is severe unprofessional conduct under BPC §1680.[^A15] An adult patient who believes the record is incomplete or incorrect may attach their own addendum of up to `250 words` per disputed item, which must stay with the chart and travel with any future disclosure of the disputed portion.[^A26] The provider bears no liability for what the patient writes in it.[^A26] **Memorize it:** **"The 250 Club"** — 250-word patient addendum limit per disputed item; never delete, only append. ### Closure and disposal retention On facility closure, HSC §123145 sets the floors: adult records at least `7 years` from discharge or last service, and unemancipated minors' records at least `1 year` past age `18` — never less than `7 years` total.[^A10] Locking the doors and walking away is patient abandonment and a major Dental Practice Act violation.[^A10] Medi-Cal (Denti-Cal) charts must be kept at least `10 years` under Welfare & Institutions Code §14124.1 — measured from the date of service, audit completion, or contract end, whichever is later — which overrides the generic `7-year` closure floor for those patients.[^A67] These are minimums; liability protection often calls for keeping records longer. **Memorize it:** **"7-after-discharge / 1-after-18 / 10-for-Medi-Cal"** — adults: 7 years from last visit; minors: 1 year past age 18, never under 7 years total; Medi-Cal (Denti-Cal) patients: 10 years. ### Breach notification (updated for 2026) For breaches discovered on or after January 1, 2026, SB 446's rewrite of Civil Code §1798.82 requires notice to affected California residents **no later than 30 calendar days** after discovery — the old "without unreasonable delay" wording is a stale-prep trap.[^A48] [^B1] A breach affecting more than 500 California residents also requires a sample notice to the Attorney General within `15 calendar days` of notifying the individuals.[^A48] Federal HIPAA (45 CFR §164.404) allows up to `60 calendar days`, but California's stricter 30-day clock controls for California residents.[^B2] Delay is permitted only when a law enforcement agency determines the notice would impede an active criminal investigation.[^B2] **Memorize it:** **"30 in CA, 60 in DC"** — 30 calendar days for patient notice under California SB 446 (and 15 days for the AG), compared to 60 days under federal HIPAA. [^A9]: `A9` California Health & Safety Code §123110 — patient inspection, copies, form/format, fees, and unpaid-balance rule. [^A10]: `A10` California Health & Safety Code §123145 — record preservation on facility closure (7 years adults; 1 year past age 18 for minors, never under 7). [^A15]: `A15` California Business & Professions Code §§1680, 1684.1, 1684.5 — unprofessional conduct, Board records demands, daily civil penalties. [^A26]: `A26` California Health & Safety Code §§123111 and 123130 — patient addendums (250 words) and provider's HSC §123130 record-summary option. [^A48]: `A48` SB 446 amending California Civil Code §1798.82 — 30-calendar-day breach-notice deadline effective 1/1/2026. [^A67]: `A67` California Welfare & Institutions Code §14124.1 — 10-year minimum record retention for Medi-Cal (Denti-Cal) providers. [^A68]: `A68` California Health & Safety Code §123115 — limits on a minor's representative inspecting records; good-faith denial standard. [^B1]: `B1` California Confidentiality of Medical Information Act (CMIA), Civil Code §56 et seq.; valid-authorization requirements; state breach law overlay. [^B2]: `B2` HIPAA Privacy, Security, and Breach Notification Rules — 45 CFR Parts 160–164 (federal floor only; California controls when stricter). ## Related guides - [What does California dental records law require for patient access?](https://dentovio.com/guide/california-dentistry-law-ethics-exam/patient-access-and-board-requests/index.html.md) - [What California duties fall on the dental practice owner?](https://dentovio.com/guide/california-dentistry-law-ethics-exam/practice-owner-duties/index.html.md) - [What telehealth and patient-of-record rules apply in California dentistry?](https://dentovio.com/guide/california-dentistry-law-ethics-exam/scope-patient-of-record-telehealth/index.html.md)