Mississippi Anaplastology Practice Privacy Laws: A Practical Guide

Which privacy laws apply to Mississippi anaplastology practices?

There is no single HIPAA rule that automatically covers every business providing anaplastology services. A practice is a HIPAA covered entity if it is a health care provider that conducts certain covered transactions electronically, such as standard electronic billing. An independent practice that does not meet that test may still have HIPAA duties if it performs services involving protected health information on behalf of a business associate. HHS guidance on covered entities and business associates explains these distinctions.

Mississippi requirements also depend on who provides care and maintains the records. The Mississippi State Board of Medical Licensure’s medical-record rules apply to its licensees, including physicians; they address record retention, patient access, transfers, and disclosure. If your anaplastology practice operates within or for a physician’s office, hospital, or other covered organization, clarify who is the record custodian and which entity’s policies govern.

For a practical compliance review, identify whether the practice is a covered entity or business associate, document staff access and disclosure procedures, and use written agreements where HIPAA requires them. Avoid assuming that a patient’s health information is outside privacy protections simply because the service involves a prosthesis, facial image, or diagnostic photograph.

How does HIPAA protect anaplastology client records?

When HIPAA applies, information that identifies a patient and relates to their health, care, or payment for care is generally protected health information (PHI). This may include consultation notes, measurements, treatment plans, billing records, diagnostic images, and photographs associated with care. Use safeguards appropriate to the information and limit workforce access according to each person’s job duties.

The minimum necessary standard generally requires covered entities to take reasonable steps to limit PHI uses, disclosures, and requests to what is needed for the purpose. For example, staff who schedule appointments may need less clinical detail than a practitioner designing or fitting a prosthesis. The standard does not apply to provider-to-provider disclosures for treatment, disclosures to the patient, or disclosures made under a valid authorization, among other exceptions. HHS’s minimum necessary guidance describes the rule and its exceptions.

HIPAA does not require written authorization for every care-related exchange. However, if a covered practice wants to use identifiable patient images in marketing or share them for a purpose that is not otherwise permitted by the Privacy Rule, it generally needs the patient’s valid authorization. HHS marketing guidance explains when authorization is required.

How long must physicians retain medical records and diagnostic images?

HIPAA does not set a general medical-record retention period; it requires appropriate safeguards for PHI for as long as the information is maintained, including when it is disposed of. HHS’s record-retention FAQ explains that retention periods generally come from state law.

Under Mississippi State Board of Medical Licensure Rule 10.3, beginning January 1, 2026, licensees must retain medical records for at least 10 years from the patient’s last treatment for all new patients and any patient seen after January 1, 2022. This rule applies to Board licensees, not automatically to every independent anaplastologist or business. The Board’s current administrative rules state the retention requirement.

The same rule requires diagnostic or therapeutic graphic matter—including images and X-ray films—to be preserved for at least five years from the patient’s last treatment. The images must be kept longer if the patient requests that in writing. Before destroying patient records, licensees must give at least six months’ notice. For a hospital or other facility, confirm the facility’s applicable retention rules and record-custodian procedures rather than assuming the physician rule governs every record.

How can patients request access to their records?

A patient can ask the practice or record custodian for copies of relevant records, including diagnostic images. A HIPAA-covered practice must provide access to information in the designated record set, subject to limited exceptions. It generally must act within 30 calendar days; if it needs more time, it may take one additional 30-day period after giving the patient a written explanation and expected completion date within the initial period. HHS’s access-timing guidance explains these deadlines.

Mississippi’s physician-licensure rules require a licensee to provide a patient’s record to an authorized requesting party within a reasonable period. A physician may ask for written authorization before sending records to someone other than the patient, and the rules say records may not be withheld because of an unpaid medical bill, though permitted copy costs may apply. The Board’s rules on record release and copying charges provide further detail.

Patients seeking hospital medical-record access should contact the hospital’s medical-records department, since the hospital may be the custodian of its chart, imaging, and related documents. If a physician or practice does not hold the requested material, ask where it is maintained and how to submit the request there.

When may a practice disclose patient information?

A HIPAA-covered practice may generally use or disclose PHI for treatment, payment, and health care operations, subject to applicable limits. A referral or consultation between health care providers for treatment can usually occur without the patient’s written authorization. For other disclosures, the practice should confirm that a HIPAA permission or legal requirement applies; when neither does, obtain a valid written authorization before sharing identifiable information. HHS guidance on treatment, payment, and health care operations explains these permissions.

A subpoena for protected health information is not always enough by itself to authorize disclosure. A court order permits disclosure only of the PHI specifically described in the order. For a subpoena or other legal process without a court order, HIPAA generally requires the practice to receive documentation that the patient was given notice and an opportunity to object, or that the parties sought a qualified protective order. The practice must also limit disclosure as required by the applicable HIPAA rules. HHS’s subpoena and discovery guidance describes these conditions.

Train staff not to treat every request from an insurer, attorney, family member, or outside provider as automatically authorized. Verify the requester’s identity and authority, the purpose and scope of the request, and the rule that permits disclosure.

What should practices know about Mississippi’s proposed medical-facility recording restrictions?

Mississippi House Bill 1374, introduced in the 2025 Regular Session, proposed requiring all-party consent to record interactions or procedures in physicians’ offices and medical facilities. It also proposed limits on sharing identifiable patient information and penalties for violations. The Mississippi Legislature’s bill text shows what the proposal would have covered.

HB 1374 did not become law: it died in committee on February 4, 2025. Do not treat the bill’s proposed recording restrictions or penalties as current law. Its failure does not remove existing privacy duties: covered practices must continue to protect PHI, and staff should follow applicable recording, facility, and privacy policies. The bill’s legislative history records its committee outcome.

In practice, the key steps are to determine which entity controls the records, apply the relevant HIPAA and Mississippi rules, retain records and diagnostic images for the required periods, and verify the legal basis before releasing information.

FAQs

Does HIPAA apply to anaplastology practices in Mississippi?

It depends on the practice’s activities and relationships. A provider is generally a HIPAA covered entity if it conducts specified covered transactions electronically. A practice may also have HIPAA obligations as a business associate when it handles PHI on behalf of a covered entity. Being an anaplastology practice alone does not determine its status. HHS’s covered-entity guidance explains the criteria.

How long must a Mississippi physician retain medical records?

Under Mississippi Board of Medical Licensure Rule 10.3, beginning January 1, 2026, covered licensees must retain records for at least 10 years from the patient’s last treatment for new patients and patients seen after January 1, 2022. Diagnostic or therapeutic images and similar materials generally must be retained for at least five years, or longer if the patient requests it in writing. The Board’s current rules provide the details.

Can patients request copies of their medical records in Mississippi?

Yes. Patients may request copies from the physician, practice, hospital, or other record custodian. HIPAA-covered practices generally must act on an access request within 30 calendar days, subject to a possible additional 30 days with timely written notice. Mississippi physician rules require release within a reasonable period and do not permit withholding records because of an unpaid medical bill, although permitted copying charges may apply.

Did Mississippi’s 2025 proposed recording restrictions become law?

No. House Bill 1374 died in committee on February 4, 2025, so its proposed all-party recording requirement and penalties did not take effect as law. The official bill text and bill history identify the proposal and its outcome.