Delays in receiving medical records are one of the most common frustrations we hear about from healthcare offices. Whether you’re waiting on x-rays, patient histories, or treatment notes, it can feel like a simple request is suddenly wrapped in red tape. With a clear understanding of HIPAA regulations, a collaborative approach, and a steady focus on quality patient care, your clinic can reduce friction, improve communication with other offices, and navigate records-related delays with greater confidence and clarity. To make this process even easier, we’ve created a set of ready-to-use Records Request Email Templates for healthcare offices . These templates were designed to help you communicate clearly, avoid delays, and stay HIPAA- and state-compliant. Download the Records Request Email Templates A Common Scenario: When Policy Becomes a Barrier A dental office submits a request to another provider for a patient’s records, which are needed before a scheduled procedure. The other office replies that the request must be submitted through their specific online portal — and once submitted, it may take up to 30 business days to process. No confirmation is provided, and no status update is available. The patient is growing anxious, the procedure must be rescheduled, and the receiving office is left feeling frustrated and powerless. This situation doesn’t reflect a bad actor. It reflects a inefficient process, often due to: Understaffed administrative teams Lack of understanding about the HIPAA rules Overreliance on policy templates Outdated systems for records handling The good news? There are realistic, professional steps you can take to move things forward — and avoid unnecessary conflict. What the Law Says About Records Release HIPAA Right of Access Under the federal HIPAA Privacy Rule: Patients have the right to access their records. Records must be provided within 30 calendar days (with an optional 30-day extension if justified in writing). Providers may require a written request but cannot create unreasonable delays or barriers. Full guidance: HIPAA Right of Access – HHS.gov Oregon Rule (Dental): Oregon dental providers must provide records, including x-rays, within 14 days of a written request from the patient or their guardian. Refer to OAR 818-012-0030(9)(a) for direct language. Internal policies should support timely care, rather than hindering it. Records Release Toolkit These steps are designed to support your office in responding effectively, lawfully, and professionally when facing delays in receiving patient records. Clarify and Confirm Ensure the records request was received. Ask if additional documentation or formats are preferred (fax, secure email, form submission). Offer to resend or adjust the request to their stated process, so long as it does not impose unreasonable delays. Connect with the Right Person If initial communication isn’t productive, request to speak with a supervisor or office manager. Approach the conversation with the goal of: Understanding their process Building a cooperative relationship Identifying a smoother path forward for both offices Sample language: “We’d like to make this process easier for everyone involved. Who is the best person to speak with about streamlining this request and ensuring the patient receives timely care?” Provide Educational Context If helpful, you may share federal guidance or state law — not as a threat, but as context: “We understand your office has internal policies, but understand that under HIPAA and Oregon law, patient records must be released within specific timelines, and processes cannot create unreasonable delays. We’re happy to collaborate in a way that works for both offices and puts the patient’s needs first.” Empower the Patient Patients often get faster responses. Encourage them to: Submit their own written request Note the urgency for treatment Request an estimated date of release Reference their right to access under HIPAA You can also provide the patient with a link to HHS’s Right of Access page for more information. When It Might Be Information Blocking The 21st Century Cures Act prohibits covered entities from interfering with access to or use of electronic health information. While most delays are not intentional, consistent or unexplained refusals to share records may fall under the category of information blocking . To learn more: Information Blocking FAQ – HealthIT.gov Report a Complaint – OCR Use this step when education and collaboration have failed, and there’s clear harm being done to the patient’s ability to receive care. Focus on Collaboration, Not Conflict Delays in care can be deeply frustrating, especially when you’re doing everything right. Still, it’s important to remember that many offices are working with limited resources, under pressure, and with outdated systems. Most delays are not acts of harm — they are opportunities for system improvement and clearer communication. By staying professional, knowledgeable in law, and focused on the patient, your office can be a model for collaborative, compassionate compliance. Need Support? If you need help navigating a difficult records release situation, reach out anytime at: Phone: (541) 345-3875 Email: Support@OshaHipaaTraining.com And if you want to save time and take the guesswork out of your records requests, grab our free Records Request Email Template Pack — including the initial request, follow-up, and escalation messages. Get your templates here!

Annual dental infection control training isn’t optional. Learn why CDC and OSHA require all dental healthcare personnel to complete infection prevention training every year—and how your practice can stay compliant and audit-ready.

Email is one of the most common ways healthcare offices communicate — with patients, vendors, and within their own teams. Unfortunately, it’s also one of the most common ways cybercriminals try to gain access to sensitive information. One of the most deceptive tactics is the spoof email. In this blog, we’ll break down what spoof emails are, how to spot them, how to prevent them, and what to do if your office — or your patients — receive one. What Is a Spoof Email? A spoof email is a fraudulent message designed to look like it came from someone you trust — a coworker, your clinic, or even a vendor you regularly work with. Cybercriminals forge the “From” address so that the email appears to come from a legitimate source, even though it did not originate from that account. For example: A message that looks like it’s from your doctor asking you to open an attachment. An email appearing to come from a coworker requesting urgent action. An attached “voicemail” or “secure document” that looks like it’s sent from a colleague but actually contains malicious software. How to Detect a Spoof Email Spoof emails are designed to look convincing, but they usually carry warning signs. Train your team to pause and check for: Unexpected attachments or links — especially audio files, invoices, or zip files. Urgent or alarming language (“Your account will be closed!”). Sender display name vs. email address — the display name may match, but the actual email address may tell a different story. ✅ Example: dr.smith@myclinic.com ❌ Spoofed example: dr.smith@mycl1nic.com (notice the “1” instead of “i”). How to check: Hover over the sender’s name with your mouse (or tap on a phone) to reveal the full email address. Always peek under the name before trusting it. Grammatical errors or unusual phrasing — subtle signs of something not right. Suspicious headers — IT teams can check message headers to see if the email really came from your domain. Tips to Minimize Spoof Emails in Your Clinic While you can’t stop cybercriminals from attempting spoofing, you can make it harder for them to succeed: Work with your IT company to enable SPF, DKIM, and DMARC records on your email domain. These are special security settings that tell email servers which senders are authorized to use your domain name. If they aren’t set up correctly, attackers can more easily pretend to send emails as your clinic. Your IT company should be able to confirm whether you already have them in place and help configure them if you don’t. Train staff regularly on phishing and spoofing awareness. Even one click on a bad link can compromise security. Use multifactor authentication (MFA) for all accounts to add an extra layer of protection. Verify requests by another method — if you get a strange email from a coworker, call or message them directly before acting. How to Respond if Your Clinic Receives a Spoof Email If your office gets a suspicious message that appears to come from your own domain or staff: Do not click links or download attachments. Report it immediately to your IT or compliance team. Document the incident — and be sure to contact your HIPAA compliance provider for guidance on properly recording and addressing these types of events. Warn your staff so others know not to interact with the message. Work with IT to review headers and confirm it was spoofing, not a compromised account. What If Patients Receive Spoof Emails That Look Like They Came from You? This can be especially damaging to patient trust. If you learn patients have received spoofed messages appearing to come from your clinic: Notify patients ASAP — acknowledge that the email did not come from your office. Give clear instructions — tell them not to click links, open attachments, or reply. Provide reassurance — explain that their medical records and patient portals remain secure, and that this was a spoof, not a breach of your systems. * After confirming it was a spoofing email, not a compromised account . Share prevention tips — encourage patients to verify suspicious messages by calling the clinic directly. Continue monitoring — if spoofing persists, work with IT to tighten email authentication settings. Spoof emails are a growing threat in healthcare because they exploit trust — the trust patients place in their providers and the trust staff place in their colleagues. By educating your team and your patients, enabling the right protections, and responding swiftly when an incident occurs, your office can turn a potentially damaging attack into an opportunity to build stronger awareness and confidence in your security practices. FAQ: Email Spoofing in Healthcare Is email spoofing illegal? Yes. It is considered fraud and, in healthcare, spoofing can lead to HIPAA compliance issues if patient information is exposed. What does a spoofed email address look like? It may look almost identical to a real one — for example: Real : dr.smith@myclinic.com Fake : dr.smith@mycl1nic.com (with a “1” instead of an “i”). What happens if I open a spoofed email? Opening it alone usually won’t cause harm. The danger comes from clicking links, downloading attachments, or replying. Can spoofed emails be stopped completely? Not entirely, but they can be minimized. Setting up SPF, DKIM, and DMARC with your IT company, training staff, and enabling multifactor authentication all reduce the risk.

Delays in receiving medical records are one of the most common frustrations we hear about from healthcare offices. Whether you’re waiting on x-rays, patient histories, or treatment notes, it can feel like a simple request is suddenly wrapped in red tape. This blog was created to address those very questions. Instead of assuming malicious intent, we aim to foster clarity, reduce friction, and offer practical, lawful guidance for improving communication and protecting patient access. A Common Scenario: When Policy Becomes a Barrier A dental office submits a request to another provider for a patient’s records, which are needed before a scheduled procedure. The other office replies that the request must be submitted through their specific online portal — and once submitted, it may take up to 30 business days to process. No confirmation is provided, and no status update is available. The patient is growing anxious, the procedure must be rescheduled, and the receiving office is left wondering what they’re allowed to say or do. This situation doesn’t reflect a bad actor. It reflects a broken process, often due to: Understaffed administrative teams Lack of training on HIPAA timelines Overreliance on policy templates Outdated systems for records handling The good news? There are realistic, professional steps you can take to move things forward — and avoid unnecessary conflict. What the Law Says About Records Release HIPAA Right of Access Under the federal HIPAA Privacy Rule: Patients have the right to access their records. Records must be provided within 30 calendar days (with an optional 30-day extension if justified in writing). Providers may require a written request but cannot create unreasonable delays or barriers. Full guidance: HIPAA Right of Access – HHS.gov Oregon Rule (Dental): Oregon dental providers must provide records, including x-rays, within 14 days of a written request from the patient or their guardian. Refer to OAR 818-012-0030(9)(a) for direct language. Internal policies should support timely care, rather than hindering it. Records Release Toolkit These steps are designed to support your office in responding effectively, lawfully, and professionally when facing delays in receiving patient records. Clarify and Confirm Ensure the records request was received. Ask if additional documentation or formats are preferred (fax, secure email, form submission). Offer to resend or adjust the request to their stated process, so long as it does not impose unreasonable delays. Connect with the Right Person If initial communication isn’t productive, request to speak with a supervisor or office manager. Approach the conversation with the goal of: Understanding their process Building a cooperative relationship Identifying a smoother path forward for both offices Sample language: “ We’d like to make this process easier for everyone involved. Who is the best person to speak with about streamlining this request and ensuring the patient receives timely care? ” Provide Educational Context If helpful, you may share federal guidance or state law — not as a threat, but as context: “We understand your office has internal policies, but understand that under HIPAA and Oregon law, patient records must be released within specific timelines, and processes cannot create unreasonable delays. We’re happy to collaborate in a way that works for both offices and puts the patient’s needs first.” Empower the Patient Patients often get faster responses. Encourage them to: Submit their own written request • Note the urgency for treatment • Request an estimated date of release • Reference their right to access under HIPAA You can also provide the patient with a link to HHS’s Right of Access page for more information. When It Might Be Information Blocking The 21st Century Cures Act prohibits covered entities from interfering with access to or use of electronic health information. While most delays are not intentional, consistent or unexplained refusals to share records may fall under the category of information blocking. To learn more: • Information Blocking FAQ – HealthIT.gov • Report a Complaint – OCR Use this step when education and collaboration have failed, and there’s clear harm being done to the patient’s ability to receive care. Focus on Collaboration, Not Conflict Delays in care can be deeply frustrating, especially when you’re doing everything right. Still, it’s important to remember that many offices are working with limited resources, under pressure, and with outdated systems. Most delays are not acts of harm — they are opportunities for system improvement and clearer communication. By staying professional, grounded in law, and centered on the patient, your office can be a model for collaborative, compassionate compliance. Need Support? If you need help navigating a difficult records release situation, reach out anytime. Healthcare COMPLIANCE Associates Phone: (541) 345-3875 Email: Support@OshaHipaaTraining.com   Subject: Request for Records – Patient Care Impacted by Delay Dear [Recipient’s Name or Office Manager], I hope this message finds you well. I’m reaching out regarding a records request submitted on [insert date] for our mutual patient, [Patient Full Name, DOB]. As of today, we have not yet received the requested information, and unfortunately, the delay is beginning to impact the patient’s ability to receive timely care. We understand and respect that every office has internal policies and procedures, and we’re happy to follow yours to the extent that they comply with state and federal law. However, we are concerned that the current delay may be inconsistent with compliance requirements. Summary of Relevant Law: Federal HIPAA Right of Access – 45 CFR 164.524 Covered entities must provide access to records within 30 days of request (or within 60 days with an extension). While a written request may be required, the entity may not impose unreasonable measures that delay access. Full guidance: HHS HIPAA Right of Access Oregon Administrative Rules (Dental-Specific) Providers must release patient records within 14 days of written request. See: OAR 818-012-0030(9)(a) & OAR 818-012-0032 We are committed to working with your office to ensure this process is smooth and compliant. Please let us know: If the records have already been sent (and we may have missed them), If there’s a specific form or additional verification needed, or If there’s someone else we should contact to help move this forward. Our goal is to ensure this patient receives timely treatment. We truly appreciate your time and efforts. Warm regards, [Your Name] [Your Title] [Your Office Name] [Phone Number] [Email Address]

Learn how to protect patient privacy on social media. A HIPAA-compliant guide for small dental and healthcare practices with cybersecurity tips and tools.

What Most Clinics Get Wrong About Infection Control Too many clinics make assumptions that lead to risk. Let’s clear up the two biggest misconceptions: ❌ Misconception #1: Only Licensed Providers Need Training Every Two Years The Truth: Infection control training isn’t just for dentists or hygienists. Every team member who may be exposed to bloodborne pathogens or infectious materials—including front desk staff and janitorial crew—should receive training annually at a minimum. ❌ Misconception #2 : OSHA and Infection Control Training Are the Same The Truth: While some topics overlap, they have different goals. OSHA training focuses on protecting employees from workplace hazards. Infection control training focuses on preventing disease transmission to protect patients, staff, and anyone entering the clinic. Not recognizing this difference can create compliance gaps and increase your risk. 3 Quick Infection Control Wins You Can Use Today Confirm who’s been trained: Create or update your staff training log. Anyone potentially exposed should have documented annual training. Walk your clinic like an inspector: Look for expired supplies, unlabeled containers, or missing hand hygiene signage. These are easy-to-fix red flags. Review your exposure plan: Is it up to date and specific to your current team and workflows? If it’s collecting dust, it’s time to revise. Stay Ready Year-Round with HCA At Healthcare Compliance Associates, we make infection control training simple, specific, and stress-free. Our Infection Control Compliance Package includes: ✅ Annual Onsite + Online Training – Relevant, current, and clinic-specific ✅ Exposure Plan Workbook – Easy-to-follow and ready for inspection ✅ Facility Walk-Thru – Catch issues before they cost you ✅ Year-Round Support – Get expert answers when you need them Contact Us TODAY to learn more about how maintain compliance with ease!

Stay OSHA-compliant in 2025 with this essential checklist for dental and medical clinics. Covers safety training, TB testing, PPE, documentation, and inspections.

In healthcare, the word “HIPAA” carries weight—and sometimes, confusion. It's not uncommon for patients or their loved ones to claim that a privacy violation has occurred, even when no such breach has taken place. With the rise of online forums, social media, and secondhand information, many people feel empowered to speak up—but unfortunately, not all claims are grounded in a clear understanding of the law. So what should your clinic do when someone insists their privacy rights have been violated, but the situation appears to be a misunderstanding, miscommunication, or outright exaggeration? Here’s a clear, professional approach to handling these claims with integrity, care, and confidence. 1. Pause and Listen Carefully Even if the complaint seems misguided, every concern deserves a respectful ear. Listen without defensiveness. Let the individual fully explain their concern and take notes. The way you respond in these early moments can shape their overall perception of how seriously your office takes patient privacy. 2. Document Everything! Immediately document: Who made the complaint and when What they claimed happened Whether PHI was involved Any key phrases or direct quotes that help show the tone or seriousness of the complaint (e.g., “I’m calling my lawyer if you don’t fire them”) How your team responded in the moment Avoid including: Personal opinions, assumptions, or guesses about the person’s intentions (e.g., “they were probably lying” or “seemed unstable”) Emotional reactions or commentary (e.g., “the patient was being ridiculous”) Diagnoses, unless you're a licensed clinician referencing a known medical fact relevant to the incident Stick to observable facts and language. Your goal is to create a clear, professional record—not an interpretation of someone’s behavior. 3. Assess the Claim Objectively Not all HIPAA complaints indicate an actual violation. Sometimes patients misunderstand what HIPAA protects—or they become upset about an experience unrelated to privacy and reach for legal terminology out of frustration. Let’s define PHI (Protected Health Information): PHI includes any information that can be used to identify a patient and relates to their health status, care received, or payment for care. This can include names, addresses, birthdates, diagnoses, treatment details, or even something as simple as an appointment date—if it’s tied to the person’s identity. Ask yourself: Was any identifiable health information actually disclosed? Was the disclosure intentional or accidental? Was the recipient someone authorized to receive it? Did the patient misunderstand normal administrative processes (e.g., calling a patient’s name in the lobby, sending appointment reminders)? If there’s no PHI exposure, or the alleged "violation" falls outside the scope of HIPAA, it’s important to remain clear in your own understanding before addressing the concern further. 4. Conduct a Formal Internal Investigation Even if a claim seems unfounded, treat it with seriousness and respect. Review relevant documentation, talk to any staff involved, and consult your policies. This shows due diligence and creates internal accountability. If the complaint is clearly based on misinformation, consider it a learning opportunity—for both your team and the patient. 5. Respond with Compassion and Clarity Once you've reviewed the situation: Provide a calm, professional response Acknowledge the patient’s concerns Offer a brief explanation (in plain language) of what HIPAA does and does not cover, if appropriate Share any corrective steps taken or training provided—even if it’s just a refresher for your team Avoid legal jargon or a defensive tone. The goal is to rebuild trust, not to “win” an argument. 6. Don’t Let Emotions Guide the Response Some complaints can feel personal—especially if the patient posts online, demands punishment for a staff member, or becomes hostile. It’s essential that leadership remain steady. Avoid: Engaging in back-and-forth debates (especially on social media) Making decisions purely based on pressure or fear Escalating a situation that may simply need clear, compassionate communication If needed, consult legal counsel for guidance—especially if the patient is making legal threats or posting defamatory content. 7. Reinforce Training and Culture Regardless of the claim's validity, use the opportunity to reinforce best practices around privacy and professionalism. Offer a quick HIPAA refresher to staff and revisit your internal policies for any needed improvements. You might even review how your office handles: Social conversations inside or outside of the clinic- what isn't allowed under the HIPAA law Visible documents or whiteboards Use of devices or screens near patients Proactive steps build a culture of awareness and protect against future misunderstandings. Not every HIPAA complaint means your clinic is at fault—but every complaint is a chance to listen, learn, and lead with integrity. By responding calmly, documenting thoroughly, and reinforcing your team’s commitment to privacy, you protect both your practice and the trust your patients place in you. Need support navigating patient complaints or strengthening your privacy protocols? We’re here to help healthcare teams turn complex compliance into confident care. Reach out for resources, training, and guidance tailored to your unique needs.

Learn how healthcare practices—especially small and dental offices—can strengthen cybersecurity by breaking down silos, preparing for ransomware, and building a team-based defense. Practical, HIPAA-friendly guidance for non-technical teams.