HIPAA compliance for dental practices in Illinois

Illinois keeps obligations of its own alongside HIPAA, with different recipients and triggers from the federal rules. Beyond that, Illinois has 7 recorded rules that apply to dental practices differently from other businesses in the state — set out below with their conditions and sources.

Illinois jurisdiction record verified against primary state authority August 2026. General reference, not legal advice.

Does this reach your practice?

Two questions have to be settled before any state rule matters: whether HIPAA reaches a practice like yours, and whether Illinois's own law reaches a practice that HIPAA already covers.

Federal — is this practice a covered entity

Dental practices that electronically submit claims, check eligibility, request authorization, or have a billing service conduct those standard transactions on their behalf are HIPAA covered entities. Most modern dental practices meet that definition. Once covered, the duties below are required.

State — how Illinois law interacts with HIPAA

Illinois substitutes federal notice for part of its scheme but keeps a residual state duty of its own. Dental practices operating here should expect both a federal and a state obligation, with different recipients and triggers.

Illinois operates a bifurcated regime. Under §50, a HIPAA/HITECH covered entity or business associate that is subject to and in compliance with the HIPAA/HITECH breach-notification rules is deemed to be in compliance with the Illinois Act — the deemed-compliance substitution operates through §50. In parallel, §10(e)'s ordinary >500-resident AG threshold expressly excludes §50-compliant CEs and BAs, so a HIPAA-compliant practice is NOT subject to that ordinary AG trigger. However, when the HIPAA-compliant CE/BA is required to notify HHS, §50 imposes its own affirmative Illinois AG notice within 5 business days after HHS notice — the substitution is not a full opt-out.

What Illinois adds for dental practices specifically

Rules that exist because of the combination — not federal HIPAA, which applies the same way everywhere, and not Illinois's general breach law, which applies the same way to every business in the state.

Minor consent to treatment

Minor may consent

A physician, chiropractic physician, optometrist, advanced practice registered nurse, physician assistant, dentist or hospital may treat a minor without parental consent where obtaining consent is not reasonably feasible under the circumstances without adversely affecting the minor's health. Separately, a minor who is the victim of predatory criminal sexual assault or a related offense may consent to counseling, diagnosis or treatment as if the minor had reached the age of majority, and that consent is not voidable or subject to later disaffirmance because of minority.

Provider class: physicians, chiropractic physicians, optometrists, advanced practice registered nurses, physician assistants, dentists and hospitals
Service: emergency treatment where obtaining consent is not reasonably feasible without adversely affecting the minor's health; and counseling, diagnosis or treatment for a minor who is the victim of predatory criminal sexual assault or a related offense
Patient population: minors

Reaches this practice type through the emergency limb — the section names dentists.

What this means operationally

This is the section that names dentists, which neither § 1 nor § 1.5 does — but it is a SCOPED EMERGENCY PATHWAY, not a general dental self-consent rule. It reaches a dental practice only where obtaining parental consent is not reasonably feasible without adversely affecting the minor's health. The sexual-assault limb is a different shape again: not an emergency test and not a status test, granting full majority-equivalent consent for counseling as well as treatment, which puts a behavioral-health practice inside it without any age or session condition.

Applies when

Obtaining consent is not reasonably feasible without adversely affecting the minor's health, or
The minor is the victim of predatory criminal sexual assault or a related offense

State statute410 ILCS 210/3Minors in an emergency, or minors who are victims of a qualifying sexual offenseVerified 2026-08-29

Parental access to records

Parental right of access

Any parent, including a parent who is a minor, may consent to the performance upon their child of a health care service by a physician licensed to practice medicine in all its branches, a chiropractic physician, a licensed optometrist, a licensed advanced practice registered nurse or a licensed physician assistant, or a dental procedure by a licensed dentist. A consenting parent may inspect and copy the part of that child's records related to the specific health care service for which the parent is treated as the child's personal representative under HIPAA, 45 CFR § 164.502(g). Each appointment, referral, test, treatment, procedure or other medical intervention is a separate and distinct health care service for the purpose of determining whether a parent is treated as the child's personal representative with respect to that service.

Provider class: a physician licensed to practice medicine in all its branches, a chiropractic physician, a licensed optometrist, a licensed advanced practice registered nurse, a licensed physician assistant, or a licensed dentist for a dental procedure
Service: the specific health care service for which the parent is treated as the child's personal representative under 45 CFR § 164.502(g)

Reaches this practice type for a dental procedure, which is how the section names dentists.

What this means operationally

Illinois resolves the HIPAA personal-representative question at the granularity of the individual service rather than the relationship or the chart. A parent who consented to one appointment is the personal representative for THAT appointment, and the statutory access entitlement runs to the part of the records related to it — not to the child's file. A release process therefore cannot rest on a single patient-level determination: it has to support a service-specific evaluation and release only what that service authorises. How a practice achieves that is its own choice — manual review, tagging, logical separation — the statute sets the access granularity, not the record-keeping architecture.

Applies when

The parent consented to the specific health care service
The parent is treated as the child's personal representative under 45 CFR § 164.502(g) for that service

State statute410 ILCS 210/2Children whose parent consented to the specific serviceVerified 2026-08-29

How long records must be kept

How long the record must be kept

Every dentist shall make a record of all dental work performed for each patient, in a manner and in sufficient detail that it may be used for identification purposes. Dental records required by this Section shall be maintained for 10 years.

Provider class: every dentist
Record class: dental records

What this means operationally

The statute does not specify a trigger. It says dental records shall be maintained for ten years and never states when the ten years begin — nothing in the section supplies a date of service, a last treatment date or a last entry. A practice therefore cannot compute a destruction date from this provision alone, and the safe reading is to measure from the latest plausible event rather than the earliest. The identification-purposes standard is also a content requirement and not merely a filing one: a record too thin to identify the patient does not satisfy the section however long it is kept.

Applies when

The record is a dental record made under § 25/50

State statute225 ILCS 25/50, retention clauseDental patientsVerified 2026-08-29

Patient access to records

Parental right of access

Dental records required to be maintained under § 25/50, or copies of them, shall be made available on request to the patient or the patient's guardian. A dentist shall be entitled to reasonable reimbursement for the cost of reproducing these records, which shall not exceed the cost allowed under § 8-2001 of the Code of Civil Procedure.

Provider class: dentistry
Record class: dental records

What this means operationally

Recorded because a dentist will find it in their own practice act and should be told what it means, which is: the same access obligation and the same fee ceiling that already apply under the general statute. The practical instruction is to work from § 8-2001's schedule, since the Dental Practice Act supplies no separate figure.

Applies when

A patient or guardian requests dental records

State statute225 ILCS 25/50, access and reimbursement clauseDental patients and their guardiansVerified 2026-08-29

Provider must disclose

A dentist providing services through a mobile dental van or portable dental unit shall provide to the patient, or the patient's parent or guardian, IN WRITING, the dentist's name, license number, address, and information on how the patient or the patient's parent or guardian may obtain the patient's dental records, as provided by law.

Provider class: dentistry
Setting: a mobile dental van or portable dental unit

What this means operationally

A proactive written disclosure owed at the visit, not a response to a request — which makes it a printed-handout problem rather than a records-department one. The setting is what triggers it, so the same dentist owes it from the van and not from the practice, and the required contents are specific enough to be templated: name, license number, address, and the route to obtaining records.

Applies when

Dental services are provided through a mobile dental van or portable dental unit

State statute225 ILCS 25/50, mobile and portable unit clausePatients seen in a mobile or portable dental settingVerified 2026-08-29

Closure, transfer and custody of records

Custody on closure or transfer

Dental records are the property of the office in which dentistry is practiced.

Provider class: dentistry
Record class: dental records

What this means operationally

One sentence with consequences a dentist usually meets at the worst moment. Ownership sits with the OFFICE, not with the treating dentist — so an associate leaving a practice has no ownership claim to the charts of patients they personally treated, and a practice sale carries the records with the office rather than requiring a separate assignment. It is also the reason the ten-year duty survives a change of dentist.

Applies when

The record is a dental record

State statute225 ILCS 25/50, ownership clauseDental patientsVerified 2026-08-29

Custody on closure or transfer

A dental office that is closing and will not continue to offer dentistry services must provide notice to its patients at least 30 days prior to the closure. The notice to patients shall include an explanation of how copies of the patient's records may be accessed or obtained by the patient. The notice may be given by publication in a newspaper of general circulation in the area in which the dental office is located, or in an electronic format accessible by patients.

Provider class: dentistry
Setting: a dental office that is closing and will not continue to offer dentistry services

What this means operationally

The audience is the part to plan around. A dental office owes this notice to its patients, so publication alone is a permitted METHOD of reaching them rather than a substitute for the duty being owed to them — and the electronic option only helps if it is genuinely accessible to those patients. Note also what the section does not do: it says nothing about who keeps the records after the office closes, while the ten-year retention duty continues to run.

Applies when

A dental office is closing and will not continue to offer dentistry services

State statute225 ILCS 25/50.1Patients of a closing dental officeVerified 2026-08-29

Each rule above was read against the cited source on the date shown. General reference for compliance planning, not legal advice — confirm current text before relying on it.

Illinois breach obligations

These apply to businesses generally rather than to dental practices in particular, and they are shown after applicability because whether they reach you depends on the answer above.

Illinoisbreach data →

Individual notice deadline

Following discovery or notification of the breach, in the most expedient time possible and without unreasonable delay, subject to the specified law-enforcement delay and any measures reasonably necessary to determine the scope of the breach and restore the reasonable integrity of the data system. No numeric outer bound.

The statute does not fix a numeric outer bound. Unreasonable delay is itself a violation and may result in state enforcement action, so treat the operative timeframe as the shortest window your incident circumstances reasonably support.

State regulator notice

Required above 500 residents

For data collectors that are NOT HIPAA/HITECH covered entities or business associates operating under §50, § 10(e) requires notification to the Illinois Attorney General when a single breach requires notification of more than 500 Illinois residents, no later than when notice is provided to consumers. §10(e) expressly excludes covered entities and business associates in compliance with §50 from this ordinary >500-resident rule — for those entities the HIPAA-specific rule below governs instead.

Source: 815 ILCS 530/10 (Illinois Personal Information Protection Act)

Statewide rules that also reach dental practices

Parental right of access

Every health care practitioner shall, on the request of any patient the practitioner has treated — or of any person, entity or organization presenting a valid authorization for release signed by the patient or the patient's legally authorized representative — permit the patient, the patient's health care practitioner or authorized attorney, or that authorized requester, to examine and copy the patient's records, including those relating to diagnosis, treatment, prognosis, history, charts, pictures and plates kept in connection with the patient's treatment. A request for copies must be in writing and delivered to the practitioner.

What this means operationally

The definitions do the important work and they are counter-intuitive. 'Health care practitioner' expressly includes a medical office, health care clinic, group practice and any other organizational structure through which a licensed professional provides care — so an independent practice is a PRACTITIONER under this Act, not a facility, and the facility rule in subsection (b) is not the one that governs it. The list of practitioner types is broad: physician, dentist, podiatric physician, APRN, RN, LPN, physician assistant, clinical psychologist, clinical social worker, therapist and counsellor.

Applies when

A patient or an authorized requester asks in writing to examine or copy the record

Statewide735 ILCS 5/8-2001(c), (d) first sentencePatients treated by the practitionerVerified 2026-08-29

Deadline to respond to an access request

The requirements of § 8-2001 shall be satisfied within 30 days of receipt of a written request. If the practitioner needs more time, then WITHIN THOSE 30 DAYS the practitioner must give the requester a written statement of the reasons for the delay and the date by which the information will be provided. In any event the information must be provided no later than 60 days after receiving the request. Failure to comply with the time limit subjects the denying party to expenses and reasonable attorneys' fees incurred in any court-ordered enforcement.

What this means operationally

Illinois runs its own clock and it is stricter in shape than the federal one. The 60 days is an absolute ceiling rather than a 30-day extension that can be taken by notifying late — the written statement of reasons is itself due inside the original 30 days, so a practice that lets day 30 pass and then asks for more time has already missed the deadline it was relying on. Illinois also attaches a fee-shifting consequence the federal rule does not.

Applies when

A written request for records has been received

Exceptions

The 30 days extends to no more than 60 where a written statement of reasons and a date is given within the first 30

Statewide735 ILCS 5/8-2001(e), (g)Patients requesting their recordsVerified 2026-08-29

Limit on copy fees, format or delivery

The requester reimburses the practitioner for reasonable copying expenses not exceeding a $20 handling charge plus actual postage, plus: for paper, 75 cents per page for pages 1–25, 50 cents for pages 26–50 and 25 cents for pages beyond 50, capped at $1.25 per page for copies made from microfiche or microfilm; and for electronic records retrieved from scanning, digital imaging or other digital format, 50% of the paper per-page charge, inclusive of the storage media. Records already maintained in electronic or digital format SHALL be provided in an electronic format when so requested, and where the records system cannot create or transmit an electronic record the practitioner must inform the requester IN WRITING of the reason. Rates adjust automatically under § 8-2006. Material that cannot routinely be copied on a standard commercial photocopier, such as X-ray films, may be charged at reasonable duplication cost.

What this means operationally

Two obligations here are easy to miss because they sit inside a fee schedule. Electronic delivery is mandatory on request where the record is already electronic — not a courtesy — and a practice that cannot comply owes a WRITTEN explanation of why. The statute also closes the obvious workaround: records retrieved from scanning or digital imaging expressly do not count as microfiche or microfilm for the higher per-page cap.

Applies when

Copies of records are requested

Exceptions

Material that cannot routinely be copied on a standard commercial photocopier may be charged at reasonable duplication cost
The handling fee may not be collected from a patient or personal representative obtaining records under § 8-2001.5

Statewide735 ILCS 5/8-2001(d), (d-5)Patients and authorized requestersVerified 2026-08-29

Limit on copy fees, format or delivery

Notwithstanding any other provision of law, a health care practitioner shall provide WITHOUT CHARGE one complete copy of a patient's records where they are requested by the patient, or by an authorized requester who has provided documentation of authority to act for the patient, or by such other requester as is authorized by statute if the patient is deceased, for the purpose of supporting a claim for federal veterans' disability benefits, federal Social Security or Supplemental Security Income benefits, or Aid to the Aged, Blind, or Persons with Disabilities benefits.

What this means operationally

The exception that swallows the fee schedule for a specific and common request type. It opens 'notwithstanding any other provision of law', so it overrides the per-page charges entirely — and the trigger is the PURPOSE of the request, which means a practice has to be able to recognize a benefits-claim request at intake rather than after it has quoted a fee.

Applies when

The records are requested to support a claim for the named federal or state benefits

Exceptions

One complete copy; updated records supplied later are governed by the same subsection

Statewide735 ILCS 5/8-2001(h)Patients pursuing a benefits claimVerified 2026-08-29

Custody on closure or transfer

A health care facility or health care practitioner must provide THE PUBLIC with at least 30 days' prior notice of the closure of the facility or the practitioner's practice. The notice must include an explanation of how copies of the records may be accessed by patients. The notice may be given by publication in a newspaper of general circulation in the area in which the facility or practitioner is located.

What this means operationally

The statewide closure duty, and the baseline every profession-specific closure rule has to be measured against. Two features matter: the notice runs to the PUBLIC rather than to identified patients, and the statute names newspaper publication as a permitted method without addressing electronic notice either way. It says nothing about who holds the records after closure, so custody itself is unresolved at state level.

Applies when

A practice or facility is closing

Statewide735 ILCS 5/8-2001(f)Patients of a closing practiceVerified 2026-08-29

What applies to dental practices everywhere

Dental ePHI does not live in one system. It moves through the practice management system, digital imaging equipment, operatories, front-desk workstations, insurance transactions, laboratories, referral workflows, mobile devices, cloud backups, patient communication, and third-party support systems.

The practice management system and every user with administrative, clinical, scheduling, or billing access

Panoramic, CBCT, intraoral, and other imaging systems — including how images move between devices, workstations, laboratories, specialists, and storage

Electronic claims, eligibility verification, payment, and clearinghouse workflows

Patient portals, digital forms, e-fax, email, text messaging, appointment reminders, and referral tools

Office servers, workstations, laptops, tablets, phones, removable media, network equipment, and cloud backups

Every vendor that stores, maintains, transmits, or can remotely access the practice's ePHI

Full dentistscompliance guide →

Knowing the Illinois rule is not the same as meeting it.

The risk assessment asks what your practice actually does — which systems hold records, who reaches them, which vendors touch them — and reports against the obligations that apply to you, including the Illinois rules on this page.

Start the risk assessment