1. (1) Definitions. As used in this Rule:
2. (a) “Active patients” means any patients treated by the dentist at any time during the immediately preceding sixty (60)months.
3. (b) “Patient notification” means written notification transmitted via U.S. Mail in a form letter mailed to the patient’s last known address, or, if the patient has consented to receive electronic communications, an electronic message sent via a HIPAA-compliant electronic health record system that provides a means of electronic communication to the patient and is capable of sending the patient a notification that a message is in the patient’s portal. When “patient notification” is required by this Rule, the communication shall include a general statement of the reason for the notification, information about how the patient may obtain a copy of his or her records, and a HIPAA-compliant release by which the patient may direct that his or her records be provided to him or her or to another licensed dentist or group practice.
4. (c) “Patient record(s)” means the records of patient assessment and treatment made and kept by a dentist and/or his or her auxiliaries pursuant to Rule 270-X-2-.22.
5. (d) “Promptly” means within thirty calendar days.
6. (2) Retention of Patient Records. A dentist and/or a group practice, as applicable, shall retain all patient records for a period of not less than five (5) years from the dentist’s and/or group practice’s last professional contact with the patient, except:
7. (a) Patient records of minors shall be retained for a period of not less than one (1) year after the minor reaches the age of majority or five (5) years from the date of the dentist’s and/or group practice’s last professional contact with the patient, whichever is longer.
8. (b) Notwithstanding any other provision of this Rule, no patient record involving services which are the subject of any legal claim or proceeding, including, but not limited to, a complaint filed with the Board, shall be destroyed until two (2) years after the claim or proceeding is fully and finally resolved.
9. (c) Laboratory prescriptions must be retained for at least two years, as prescribed in Ala. Code § 34-9-21(b).
10. (3) Confidentiality of Patient Records. Except with consent of the patient or a patient’s legal representative, a dentist or group practice shall not disclose a patient record to any person other than the patient, the parent or guardian of the patient if the patient is a minor, the patient’s legal representative, some other person designated by the patient, the Board of Dental Examiners, or as may be required by a subpoena or other legally compulsory process. Upon receipt of a written request submitted by a patient or a patient’s legal representative, a dentist and/or his or her group practice shall provide a copy of the patient record to the patient or to some other person designated by the patient. Dentists may charge patients for the actual and reasonable costs of reproduction of patient records but should give primary consideration to the ethical and professional duties owed to other dentists and their patients and waive duplication charges when appropriate. Any dentist or group practice holding custody of a patient record shall have an affirmative obligation to provide a complete and unmodified copy of the record to the Board of Dental Examiners upon written demand therefor.
11. (4) Destruction of Patient Records. Patient records may be destroyed only in accordance with the following subsections (a) through (e):
12. (a) Patient records may be destroyed only in the ordinary course of business and in accordance with written office operating procedures. In no circumstance may a dentist or group practice single out or select particular patient records for destruction. Subject to the retention requirements set forth in subsection (2) of this Rule, in any circumstance in which patient notification is provided two times separated by at least 20 days and the patient has not provided instructions regarding his or her patient records, the patient’s record may be destroyed.
13. (b) When a patient record is destroyed, the destruction shall be carried out by burning, shredding, permanently deleting and overwriting (commonly known as “wiping” applicable portions of an electronic storage medium), or other effective methods rendering the information not reasonably capable of being read or reconstructed.
14. (c) When records are destroyed, the time, date, and method of the destruction shall be recorded and maintained for not less than five (5) years. The record of destruction shall be sufficient to identify which group of destroyed records contained a particular patient’s records of treatment.
15. (d) Alteration of information recorded in a patient record shall constitute destruction of the record, unless the dentist’s recordkeeping system or electronic medical record system keeps a fully retrievable copy of the information to be altered, the date and time of alteration, the reason for the alteration, and the identity of the person performing the alteration.
16. (e) When a dentist or group practice decommissions computer or other electronic equipment, the dentist or group practice shall take reasonable steps to ensure that all patient records or portions thereof stored on the equipment are destroyed in a manner rendering the information not reasonably capable of being read or reconstructed.
17. (5) Specific Events Requiring Patient Notification and Disposition of Patient Records. Dentists should plan in advance and make provision for the provision of patient notification, and the storage and disposition of patient records, as provided below:
18. (a) Retirement from Practice: If a dentist intends to retire from the practice of dentistry, including the closure or sale of an active solo practice, patient notification shall be sent to the dentist’s active patients at least 60 days before retirement. Provided, however, that if the dentist is a member of a group practice at the time of retirement, patient notification is encouraged but is not required, and the group practice may maintain custody of the patient records of the retired dentist unless otherwise directed by the patient.
19. (b) Death While Practicing Dentistry: Dentists are strongly encouraged to make advance plans and arrangements for providing patient notification in the event of the dentist’s death. If a dentist dies while he or she has active patients, the personal representative of the dentist should provide for the secure storage of all patient records, should provide patient notification to active patients, and should follow the directions received from patients with regard to the disposition of patient records. It is permissible for a dentist to agree in writing with another dentist that, upon the death of one of the dentists, all patient records of the deceased dentist will be transferred to the custody of the surviving dentist, provided that patient notification is promptly provided by the surviving dentist. If the dentist is a member of a group practice at the time of death, patient notification is encouraged but is not required, and the group practice may maintain custody of the patient records of the deceased dentist unless otherwise directed by the patient.
20. (c) Departure from Group Practice: If a dentist leaves a group practice and continues to practice dentistry, patient notification to the departing dentist’s active patients is encouraged but not required promptly upon the dentist’s departure from the practice. The written employment agreement, partnership agreement, company agreement, or other written contract between the dentist and group practice may make reasonable arrangements for the provision of patient notification and the allocation of the costs associated with providing patient notification, as long as such provisions do not have the purpose or effect of inhibiting free competition among dentists or the inhibition of free patient choice.
21. (d) Revocation or Suspension of License: When a dentist’s dental license is suspended or revoked, the dentist shall promptly send patient notification of the suspension or revocation to all of the dentist’s active patients. The cost of sending the patient notification shall be borne by the dentist whose license is suspended or revoked.
22. (6) Abandonment of Records Prohibited. It shall be a violation of this Rule and of Ala. Code § 34-9-18(a)(15) for a dentist to intentionally close or abandon his or her practice without making provision for the maintenance, security, transfer, or to otherwise establish a secure method of patient access to their records.
23. (7) Professional Responsibility. Each individual licensed dentist is professionally responsible for complying with his or her own obligations under this Rule. Where this Rule imposes obligations on a group practice, all licensed dentists who are partners, members, shareholders, or other equity holders in the group practice shall be jointly and severally professionally responsible for ensuring that the group practice complies with this Rule.
24. (8) Violations. Violation of any provision of this Rule is grounds for disciplinary action pursuant to Ala. Code § 34-9-18(a)(16).

Author: Board of Dental Examiners of Alabama

Statutory Authority: Code of Ala. 1975, §34-9-43.

History: New Rule: Published December 31, 2024; effective February 14, 2025.