Conversations recorded between dentists and patients without permission from either party can create serious legal risks for dental professionals. In California, nonconsensual recordings violate HIPAA and state privacy laws, which can lead to fines and possible jail time.
The California Invasion of Privacy Act prohibits eavesdropping and requires all parties to consent to recording confidential information. As part of their patient privacy policies, dentists should inform patients that using any device to record is prohibited. Dental team members should receive education on the potential risks associated with recorded conversations.
With wearable devices such as smart glasses becoming more mainstream and capable of recording anytime, anywhere, dental teams must be able to identify these and similar advanced technologies and be familiar with their practice’s policy for use.
Should a dental office ask a patient to remove their smart glasses?
“Absolutely not,” says Teresa Pichay, CDA’s senior regulatory compliance analyst. “The patient could be wearing the glasses for visual accommodation. But staff can confirm with the patient that recording functions are turned off. Having and communicating a patient code of conduct will help these interactions go more smoothly.”
Signage or a written notice given to patients could state:
Due to potential acquisition of other patients protected health information (PHI), recording any part of or your visit to our office is strictly prohibited.
Some patients might ask to record; others might record surreptitiously
Member-dentists have shared that more patients are asking to record their office visits, according to Pichay and Risk Management analysts with The Dentists Insurance Company. A similar trend is occurring in physicians’ offices, and providers are not always sure how to respond. Some patients record surreptitiously, perhaps thinking that doing so is allowed in an age when documenting and sharing first-person experiences is common and a popular social media format.
Patients have asked to record audio and video with their smartphones, mistakenly believing that their HIPAA-protected right to access medical or dental records includes the right to record conversations with their health care providers. On the face of it, such recording might seem innocent or even beneficial—denoting an individual advocating for their own health—but here is more on why recording is risky for dental team and patients.
Privacy concerns and potential violation of HIPAA privacy law
Under HIPAA, patients have the right to access their medical records, but they do not have the right to record their conversations with their dentist without explicit consent.
Recording peripheral conversations in the dental office, such as those between team members, could easily violate HIPAA privacy law, as the conversations may inadvertently contain sensitive patient information, resulting in a breach of patient confidentiality.
Recordings may take place without the dental team’s knowledge, especially as less obtrusive wearable technology becomes more popular.
Pichay reminds dental offices that they must provide a Notice of Privacy Practices to every patient on their first visit. CDA’s Sample Notice of Privacy Practices can assist members.
Use and consent: Avoid risk of manipulated and unwanted distribution of recordings
All dentists must ensure that any recordings made in their office are done with the explicit consent of all parties, as mandated by the California privacy law. “Verbal consent, if recorded, is acceptable, but written consent is preferred,” Pichay notes.
Failure to obtain consent can result in legal repercussions, including a fine up to $2,500 per violation and up to one year in jail. (Previous convictions result in a significantly higher fine.)
Once a patient who has recorded a conversation with the dentist leaves the office, the practice no longer has control over how the recorded content is used or whether it is altered.
Patients could edit the recording, or the recording could be used or distributed by third parties, such as social media or news outlets, without the practice’s consent. Artificial intelligence might even analyze the recording, potentially revealing sensitive patient information. The recording could also be used as a means of intimidation or coercion.
In addition to following federal privacy laws, California requires two-party consent, meaning that to be legal, all parties must consent to the recording of a conversation, including dentists, staff and patients. Failure to obtain consent can result in legal repercussions, including a fine up to $2,500 per violation and up to one year of imprisonment. (Previous convictions result in a significantly higher fine.)
What if the dental office uses an AI scribe?
An AI scribe is software that records conversation between the patient and health care provider and drafts clinical notes. A dental practice that uses an AI scribe must obtain the patient’s consent to use the scribe to record or transcribe the conversation.
CDA members can sign in to use the sample AI Scribe Patient Consent Form developed by CDA’s regulatory compliance analysts. Included with the form are six questions that patients might ask before they sign the consent form. Dental team members should be prepared to answer them before launching the AI software.
How to respond to patients who ask to record or who record without consent
If a patient asks to record a conversation or interaction, the dental team should first advise the patient that digital recordings by any device, whether a handheld smartphone or wearable technology, are prohibited by federal and state privacy laws to protect the privacy of other patients and staff.
If the patient insists on recording, the dental team can encourage them to take notes or to bring a trusted family member to appointments to take notes and help the patient remember the conversation.
If the dental team discovers a patient recording without consent, they should immediately instruct the patient to stop recording, citing possible privacy law violations.
If a nonconsensual recording contains protected health information, the practice is required to report the incident to the U.S. Department of Health and Human Services Office for Civil Rights. Impermissible recording can also be reported to law enforcement.
The practice should also advise the patient that any further violation may result in their dismissal from the practice once treatment is complete. (Dentists should discuss with their legal counsel before dismissing a patient. CDA members can also contact CDA’s regulatory compliance experts or TDIC’s Risk Management Advice Line as a benefit of membership.)
An opportunity to identify patients who need extra attention
Patients who request to record could be signaling their need for more explanation or time to better understand their condition and recommended treatment. Some thoughtful questions posed by the dentist may reveal the motivation behind the patient’s request. Remind the patient that they are welcome to take notes to help them remember important information after they leave the office. Also let them know that treatment information is recorded in their patient record, which they can request at any time.