Patient Records in a Dental Practice Sale

What does records custody mean in a practice sale?

Custody is the ongoing responsibility to hold and manage records under the applicable duties. It includes more than moving a database from one computer to another. The plan needs to address patient requests, lawful seller access, storage, security, retention and eventual disposal.

The ADA's sale guidance identifies records and post-sale access as matters to plan. Use it to frame the discussion, then have healthcare counsel apply the relevant rules and contract terms. A national guide cannot assign custody or determine what notice is required for every practice. (Source: ADA: Patient records when selling a practice; checked September 5, 2026.)

Start with an inventory of where records live. Include paper charts, practice software, imaging systems, scanned forms and off-site storage where present. Ask the clinical and technology teams which items are needed to reconstruct care. A financial export that lists patient balances is not a complete clinical record.

Which responsibilities must be assigned before closing?

Use a custody matrix with a named person or entity for each duty. The purchase agreement, vendor arrangements and operating plan should tell the same story. If the buyer will hold the records, define how lawful seller access will work without leaving uncontrolled shared accounts.

Do not leave a duty assigned to the old practice when that entity will no longer have staff or systems. Identify who can perform the work after the seller retires. If responsibility changes later, the parties need a route to update the contact and preserve access.

What may be shared during buyer diligence?

Begin commercial screening with summary reports that do not identify patients. Define the financial or operational question before requesting more detail. The buyer can often review receipt trends, provider production and age bands without a named patient list.

HHS guidance addresses permitted treatment, payment and health-care-operations uses, including specified sale or transfer activities. That is not unlimited permission for every bidder or advisor to receive an entire database. Counsel should identify the lawful pathway, the participants and applicable limits for the actual transaction. (Source: HHS: Treatment, payment and health-care operations; checked September 5, 2026.)

A buyer NDA protects commercial confidentiality but does not create a HIPAA permission by itself. The HHS Privacy Rule summary explains the broader permitted-use and authorization framework. Resolve the basis before sharing identifiable records, then use access controls appropriate to the information. (Source: HHS: Summary of the HIPAA Privacy Rule; checked September 5, 2026.)

Keep a separate access log for protected material. Record the purpose, recipient, approved scope and means of access. If the buyer withdraws, follow the agreed and legally appropriate process for access removal and retained copies. Do not assume a deleted data-room account removes every downloaded file.

How do advisors and vendors fit the privacy process?

Identify what each outside person will do and what information that task requires. A software vendor, billing service, accountant or clinical reviewer may have different roles. Ask counsel which arrangements and safeguards are required before access begins.

HHS describes business-associate functions and agreements. A business-associate agreement is not a general waiver allowing any use of patient data. The role and permitted task still matter. Do not ask a vendor to repurpose records for a buyer's unrelated marketing campaign. (Source: HHS: Business associates; checked September 5, 2026.)

Use named accounts and appropriate permissions for the work. Decide who approves access, who can export records and when permissions end. Share credentials through the agreed secure process. A generic administrator password handed to everyone makes it difficult to trace who changed or viewed information.

Which retention and notice rules should be checked?

HHS states that the HIPAA Privacy Rule does not set medical-record retention periods. State law generally supplies those periods, while HIPAA safeguards remain relevant as records are held and disposed of. This does not remove other legal, contract or litigation-hold duties. (Source: HHS: HIPAA and medical-record retention; checked September 5, 2026.)

New York's dentistry guidance says records must be retained at least six years, with minor records kept at least six years and until one year after age 21. That is a New York statement, not a national rule. Have counsel apply the requirements to the actual records and any longer duties. (Source: NYSED: Dentistry practice guidelines; checked September 5, 2026.)

Texas provides a records-designation process concerning ownership and custody. The form identifies a task to investigate; it is not a full summary of Texas transfer, notice or retention law. (Source: Texas Board: Designation of records; checked September 5, 2026.)

Ask the relevant board and healthcare attorney about patient notice, closure, minors, access and record types. Keep the source date and the applicable rule in the file. Do not shorten retention merely because the practice has been sold or the prior software contract is ending.

How should the software transfer be planned?

Define what transfers before agreeing to a conversion fee. Ask about chart notes, images, document attachments, signed forms, balances and historical reports. Identify material that needs a separate viewer or archive. The clinical team should define what successful retrieval looks like.

A vendor's completed-import message reports a technical step. It does not prove clinical completeness. Agree on test cases and responsibility for correcting exceptions. Ask who can authorize the final cutover and what evidence that decision requires.

What does a practical migration test show?

The following numbers are invented to explain a test log. They are not a required sample size or an acceptable clinical error rate. Suppose the team selects 250 checks across notes, images and attachments using its own risk-based plan.

The pass share is 96% for the selected checks. That does not establish a 96% success rate for the entire database or prove readiness for clinical use. The 10 exceptions may include issues that matter greatly to care. A high average can conceal one critical failure.

For each exception, record the affected item, expected result, actual result and owner. Use nonidentifying references in general project reports. Keep any patient-level detail in the approved secure system. Retest the corrected item and any related class of records that the team identifies as at risk.

Agree on a fallback before cutover. The fallback should preserve lawful access and a way to support care if the new system cannot retrieve needed history. Do not destroy the original source merely because one test batch passed.

How are patient requests handled after the handover?

Give staff a clear contact route and procedure. A patient should not be bounced between the retired seller, the buyer and the software vendor because no one owns the request. Define how identity and authority are checked and who handles exceptions.

Use counsel-approved notices and response procedures that fit the applicable rules. This guide does not prescribe one national response deadline, fee or notice method. Ask how requests received just before closing will be tracked so they do not disappear during the handover.

Keep a request log with dates, status and the responsible person. Limit the information in that log to what the workflow needs. Review unresolved requests at the first operating handover meeting and route clinical questions to qualified clinicians.

What access might the seller need later?

A seller may need lawful access for a care question, claim or other legitimate matter. Define the request path, scope, security and cost arrangements in advance with counsel. Continued ownership of a login is not the only way to address a valid access need.

Ask what happens if the buyer changes software, closes or sells again. The custody plan should address continuity of responsibility and the contacts needed for future requests. It should not rely solely on the personal availability of one employee who may leave.

Keep records-access questions distinct from ownership of receivables. A seller collecting old balances does not automatically receive unrestricted use of all clinical information. Match access to the lawful purpose and agreed controls.

Common mistakes in records transfer and custody

One mistake is using an NDA as the sole privacy control. Another is counting patient rows after import and assuming all images and attachments arrived. A third is treating a retained software backup as a usable archive without testing how anyone will retrieve it.

Also avoid leaving costs undefined. A low conversion quote can omit archive access, hosting or support. Ask for recurring costs and the period of access required by the actual retention plan. Compare the budget with duties that continue after closing.

Do not promise patients that every aspect of record access will remain unchanged without checking the plan. Coordinate the message, contact details and request workflow before it is sent. Staff need practical instructions they can carry out on the first day after transfer.

Summary: keep legal custody and usable access together

Name the custodian and verify the transfer basis. Inventory the records, test retrieval and resolve material exceptions through the responsible team. Define requests, lawful seller access, retention and costs. Closing should leave a workable system for patients and clinicians, with evidence of who remains responsible.