HIPAA compliance for optometry practices in Ohio

Ohio's general breach-notification statute excludes HIPAA covered entities outright, so for covered optometry practices the federal rules govern and the state statute adds no separate notification duty. Beyond that, Ohio has 4 recorded rules that apply to optometry practices differently from other businesses in the state — set out below with their conditions and sources.

Ohio jurisdiction record verified against primary state authority August 2026. General reference, not legal advice.

Does this reach your practice?

Two questions have to be settled before any state rule matters: whether HIPAA reaches a practice like yours, and whether Ohio's own law reaches a practice that HIPAA already covers.

Federal — is this practice a covered entity

Optometry practices that electronically conduct medical or vision-plan claims, eligibility, authorization, or other adopted transactions are HIPAA covered entities. The retail optical side does not erase the clinical entity's obligations. Once covered, the duties below are required.

State — how Ohio law interacts with HIPAA

Ohio's general breach-notification statute expressly excludes HIPAA covered entities from its scope. For optometry practices that qualify as covered entities under 45 CFR §160.103, the federal rules govern and the state statute below adds no separate notification duty.

Covered-entity exclusion. Ohio Rev. Code § 1349.19(F)(2) provides that '[t]his section does not apply to any person or entity that is a covered entity as defined in 45 C.F.R. 160.103.' HIPAA covered entities operating in Ohio are excluded from § 1349.19 — no residual state-law breach-notification obligation runs alongside HIPAA for CEs. Business associates are NOT expressly included in the (F)(2) exclusion and require separate analysis — a BA should independently evaluate whether it qualifies as a covered entity under 45 C.F.R. 160.103 (which enumerates health plans, healthcare clearinghouses, and qualifying healthcare providers as covered entities and separately defines business associate) or whether some other Ohio provision applies to it. Financial institutions, trust companies, and credit unions subject to and complying with their functional federal regulator's requirements are also excluded from § 1349.19 under (F)(1).

What Ohio adds for optometry practices specifically

Rules that exist because of the combination — not federal HIPAA, which applies the same way everywhere, and not Ohio's general breach law, which applies the same way to every business in the state.

How long records must be kept

How long the record must be kept

ALL PATIENT RECORDS MUST BE MAINTAINED BY THE EXAMINING OPTOMETRIST FOR SEVEN YEARS UNLESS RELEASED TO ANOTHER OPTOMETRIST FOR CUSTODY. PATIENT RECORDS INCLUDE examinations, furnishing legend therapeutic agents, and patients for whom OPTICAL ACCESSORIES HAVE BEEN DISPENSED. THE FAILURE TO KEEP FOR A PERIOD OF AT LEAST SEVEN YEARS a complete record of all patients examined or furnished legend therapeutic agents and of all patients for whom optical accessories have been adapted CONSTITUTES DISHONESTY OR UNPROFESSIONAL CONDUCT as that phrase is used in R.C. § 4725.19.

Provider class: Ohio optometrists

What this means operationally

Read the UNLESS clause as a custody transfer, not as an escape. The seven-year duty attaches to the EXAMINING optometrist personally, and releasing records to another optometrist for custody moves who holds it — it does not extinguish the obligation or shorten the period, and the transfer route is only available to another optometrist. The record class is also broader than a clinical chart: it expressly reaches patients for whom OPTICAL ACCESSORIES were dispensed or adapted, so a dispensing-only interaction generates a seven-year record. Enforcement runs through license discipline as dishonesty or unprofessional conduct. ONE THING THE RULE DOES NOT SAY: it states no CLOCK for the seven years. Not from last examination, not from last dispensing, not from record creation. The trigger is recorded as NOT_SPECIFIED_BY_THIS_AUTHORITY rather than assumed, and a practice should measure from the latest defensible event in the file rather than the earliest.

Applies when

An Ohio optometrist examines a patient, furnishes legend therapeutic agents, or dispenses or adapts optical accessories

Exceptions

The seven-year duty may PASS to another optometrist who takes custody. Transfer moves who holds the obligation; it does not extinguish it, shorten the period, or permit destruction, and the transferee must be another optometrist

State regulationOhio Admin. Code 4725-5-11, retention limbsPatients of the practiceVerified 2026-08-30

Duty to keep an accurate record

Records MAY BE MAINTAINED AS PAPER OR ELECTRONIC FILES. IF RECORDS ARE MAINTAINED ELECTRONICALLY, A BACKUP FILE WILL BE MAINTAINED OFF SITE. THE COMPUTER WILL ALSO BE KEYED TO RECORD THE TIME AND DATE OF ANY RECORDS TRANSACTIONS OR ALTERATIONS.

Provider class: Ohio optometrists

What this means operationally

Two system requirements stated as rules rather than recommendations, and neither is satisfied by a general IT policy. An OFF-SITE backup is mandatory the moment records go electronic — an on-premises backup does not qualify, and a cloud arrangement needs checking against where the data actually sits. The second is an audit-trail requirement: the system must record the time and date of any transaction OR ALTERATION, which is a record-integrity control of the same family as the Texas amendment rule and should be treated as a procurement criterion, because a system that cannot log alterations cannot be made compliant by policy.

Applies when

An Ohio optometrist maintains patient records electronically

State regulationOhio Admin. Code 4725-5-11, electronic-records limbPatients of the practiceVerified 2026-08-30

Closure, transfer and custody of records

Custody on closure or transfer

UPON RETIREMENT OR TERMINATION OF PRACTICE, patient records MAY BE TRANSFERRED TO ANOTHER OPTOMETRIST FOR CUSTODY. A WRITTEN CUSTODY AGREEMENT MUST BE EXECUTED, SIGNED AND RETAINED BY BOTH PARTIES. Patients SHOULD BE NOTIFIED of the transfer and ALSO INFORMED THAT THE RECORDS CAN BE FORWARDED TO AN OPTOMETRIST OF THEIR CHOICE. If the optometrist CHOOSES TO RETAIN patient records, CURRENT PATIENTS MUST BE NOTIFIED OF THE LOCATION of their records. THE FAILURE TO TIMELY RELEASE patient records upon a proper request OR TO NOTIFY CURRENT PATIENTS OF A CHANGE OF LOCATION where their records are maintained CONSTITUTES DISHONESTY OR UNPROFESSIONAL CONDUCT under R.C. § 4725.19.

Provider class: Ohio optometrists

What this means operationally

Both branches carry a duty, which is what practices miss: transferring custody requires a WRITTEN AGREEMENT signed and retained by both sides, and retaining the records yourself requires notifying current patients where they now live. There is no route that involves doing nothing. The patient-choice element is also substantive rather than courteous — patients must be told the records can go to an optometrist of THEIR choosing, so a transfer arrangement cannot be presented as final. Failure on either limb is license-level misconduct, not a private matter between the optometrists.

Applies when

An Ohio optometrist retires, terminates practice, or changes the location where records are maintained

State regulationOhio Admin. Code 4725-5-11, custody and notification limbsPatients of the practiceVerified 2026-08-30

Release prohibited

An optometrist DEPARTING FROM A PRACTICE AT A LEASED LOCATION MAY TRANSFER RECORDS TO ANOTHER OPTOMETRIST FOR CUSTODY. The optometrist MAY ALLOW COPIES OF PATIENT PRESCRIPTIONS TO REMAIN AT THE LEASED LOCATION BUT IS PROHIBITED FROM RELEASING FULL PATIENT RECORDS TO ANY NON-LICENSED INDIVIDUAL, UNLESS THE PATIENT PROVIDES WRITTEN AUTHORIZATION TO THE OPTOMETRIST.

Provider class: Ohio optometrists

What this means operationally

This is aimed squarely at the retail optical arrangement, where an optometrist practices inside a commercial host's premises under a lease. On departure the host may keep copies of PRESCRIPTIONS — which is what it needs to keep dispensing — but full patient records may not be left with or handed to a non-licensee without each patient's written authorization. A practice negotiating a lease should settle this before signing, because the rule binds the departing optometrist personally and no lease term can authorize the release.

Applies when

An Ohio optometrist departs from a practice at a leased location

Exceptions

Copies of patient prescriptions may remain at the leased location
Full records may be released to a non-licensee where the patient gives written authorization to the optometrist

State regulationOhio Admin. Code 4725-5-11, leased-location limbPatients of the practiceVerified 2026-08-30

Each rule above was read against the cited source on the date shown. General reference for compliance planning, not legal advice — confirm current text before relying on it.

Ohio breach obligations

These apply to businesses generally rather than to optometry practices in particular, and they are shown after applicability because whether they reach you depends on the answer above.

Ohiobreach data →

Individual notice deadline

In the most expedient time possible but not later than forty-five days following discovery or notification of the breach, subject to law-enforcement delay and any measures reasonably necessary to determine the scope of the breach, ascertain the identity of affected residents, and restore the reasonable integrity of the data system.

The statute sets a 45-day outer bound. It is shown for context: a HIPAA covered entity is outside this section, so HIPAA's own 60-day individual-notice window is the operative deadline.

State regulator notice

Not required

None for HIPAA-covered entities (they are excluded from the section entirely — see the HIPAA-interaction note below). For entities subject to § 1349.19, the section does not impose an Attorney General notice obligation.

Source: Ohio Rev. Code § 1349.19(B)(2)

Statewide rules that also reach optometry practices

Parental right of access

A patient, a patient's personal representative, or an authorized person who wishes to examine or obtain a copy of part or all of a medical record SHALL SUBMIT TO THE HEALTH CARE PROVIDER A WRITTEN REQUEST SIGNED by the requester and DATED NOT MORE THAN ONE YEAR BEFORE THE DATE ON WHICH IT IS SUBMITTED. The request SHALL INDICATE WHETHER THE COPY IS TO BE SENT to the requester, sent to a physician, advanced practice registered nurse or chiropractor, or HELD FOR THE REQUESTER at the office of the health care provider. WITHIN A REASONABLE TIME after receiving a request that meets those requirements and includes sufficient information to identify the record, a health care provider that has the patient's medical records SHALL PERMIT THE PATIENT TO EXAMINE THE RECORD DURING REGULAR BUSINESS HOURS WITHOUT CHARGE or, on request, shall provide a copy in accordance with § 3701.741. If a health care provider FAILS TO FURNISH a medical record as required, the requester MAY BRING A CIVIL ACTION to enforce the patient's right of access.

What this means operationally

Two conditions sit on the REQUEST rather than the practice, and both are enforceable gatekeeping. The request must be signed, and it must be DATED NOT MORE THAN ONE YEAR before submission — a staleness rule that lets a practice decline an old authorization without inventing a policy. It must also state the destination, which is why a bare 'send me my records' note is incomplete under Ohio law. On the practice's side, in-person EXAMINATION is free and must be available in regular business hours; only copying attracts a fee. Note what Ohio does not give: no day count. The standard is a reasonable time, and the sanction is a private civil action rather than board discipline.

Applies when

A patient, personal representative or authorized person submits a signed written request dated within the past year, identifying the record and stating where the copy should go

Exceptions

Does not apply to records covered by Ohio Rev. Code §§ 173.20 or 3721.13, chapters 1347, 5119 or 5122, 42 C.F.R. part 2 (alcohol and drug abuse patient records), or 42 C.F.R. § 483.10
Does not supersede the peer-review confidentiality provisions at §§ 2305.24, 2305.25, 2305.251 and 2305.252

StatewideOhio Rev. Code § 3701.74(B), (C), (D)Patients, personal representatives and authorized personsVerified 2026-08-30

Limit on copy fees, format or delivery

Where the request is made by the PATIENT, the patient's personal representative, or an individual authorized through a valid power of attorney, TOTAL COSTS for copies and all related services SHALL BE REASONABLE, COST-BASED AMOUNTS PERMITTED TO BE CHARGED TO THE PATIENT UNDER FEDERAL LAWS AND REGULATIONS, and any per-page charges SHALL NOT EXCEED the sums authorized for third-party requests. If the request by such a person is for ACCESS TO DIGITAL RECORDS OR ELECTRONICALLY TRANSMITTED RECORDS, the TOTAL COST for that access or transmission, AND ALL RELATED SERVICES, SHALL NOT EXCEED FIFTY DOLLARS.

What this means operationally

The fifty-dollar cap is the number to build the workflow around: it is a TOTAL, covering access, transmission and every related service, and it applies regardless of how large the record is. For any substantial chart electronic delivery is therefore dramatically cheaper for the requester than paper, and a practice that defaults to printing is charging more than it needs to defend. For non-digital patient requests Ohio does not write its own figure at all — it adopts the federal cost-based limit by reference and then caps per-page charges at the third-party schedule, so the federal rules are the operative constraint and the state schedule is only a ceiling.

Applies when

A patient, personal representative or power-of-attorney holder requests copies of a medical record

StatewideOhio Rev. Code § 3701.741(B)(1)Patients, personal representatives and authorized personsVerified 2026-08-30

Limit on copy fees, format or delivery

Where the request is made by ANYONE OTHER THAN the patient, personal representative or power-of-attorney holder, total costs for copies and all related services SHALL NOT EXCEED the sum of: AN INITIAL FEE OF SIXTEEN DOLLARS AND EIGHTY-FOUR CENTS, adjusted in accordance with § 3701.742, WHICH SHALL COMPENSATE FOR THE RECORDS SEARCH; for data recorded on paper or electronically, ONE DOLLAR AND ELEVEN CENTS PER PAGE FOR THE FIRST TEN PAGES, FIFTY-SEVEN CENTS PER PAGE FOR PAGES ELEVEN THROUGH FIFTY, and TWENTY-THREE CENTS PER PAGE FOR PAGES FIFTY-ONE AND HIGHER, each adjusted under § 3701.742; for data resulting from an X-RAY, MRI OR CAT SCAN recorded on paper or film, ONE DOLLAR AND EIGHTY-SEVEN CENTS PER PAGE; and THE ACTUAL COST OF ANY RELATED POSTAGE. Every charge in this schedule applies to MEDICAL RECORDS COMPANIES as well as to health care providers.

What this means operationally

Ohio is unusual in letting the practice recover a SEARCH fee at all — most cost-based regimes exclude retrieval time — and it is a flat initial charge rather than an hourly one. The per-page rate is steeply degressive, so the marginal cost of a long record is low and the fixed component dominates a short one. Two structural points matter more than the figures. All of them are INFLATION-ADJUSTED under § 3701.742, so any quoted amount needs a date beside it. And the schedule expressly binds MEDICAL RECORDS COMPANIES, the third-party firms practices outsource copying to, which prevents a practice from routing around the cap through a vendor.

Applies when

A third party such as an attorney or insurer requests copies of a medical record from a provider or a medical records company

Exceptions

One free copy, and one copy of subsequently created records, must be provided without charge to the Bureau of Workers’ Compensation and the other recipients § 3701.741(C) names

StatewideOhio Rev. Code § 3701.741(A), (B)(2)Patients, personal representatives and authorized personsVerified 2026-08-30

What applies to optometry practices everywhere

Optometry crosses clinical care, diagnostic imaging, insurance, prescription transmission, laboratory fulfillment, and retail operations. The SRA must follow patient information across all of those boundaries.

The EHR or practice-management system and access across clinical, optical, billing, and administrative roles

OCT, retinal photography, visual-field, corneal-topography, and other diagnostic systems

The movement and storage of diagnostic images between instruments, workstations, the EHR, specialists, and backup systems

Medical-insurance and vision-plan billing workflows, clearinghouses, and eligibility systems

Prescription transmission, optical-lab, specialty-lens, and fulfillment workflows involving identifiable patient information

Patient portals, scheduling, intake, email, text messaging, and order-status communication

Full optometristscompliance guide →

Knowing the Ohio rule is not the same as meeting it.

The risk assessment asks what your practice actually does — which systems hold records, who reaches them, which vendors touch them — and reports against the obligations that apply to you, including the Ohio rules on this page.

Start the risk assessment