Mississippi Dermatology Mohs Surgery Privacy Guide: What Patients Need to Know About HIPAA, Consent, and Medical Records

This guide explains how your dermatology and Mohs surgery information is protected, how you can access it, and when it may be shared. It blends HIPAA basics with Mississippi-specific rules so you know your rights and what to expect before and after skin cancer treatment.

HIPAA Privacy Rule Compliance

The HIPAA Privacy Rule sets national standards for how covered health care providers use and disclose protected health information (PHI). In general, your PHI may be used or shared without your written permission for treatment, payment, and health care operations; most other uses require a HIPAA Authorization. Providers must give you a Notice of Privacy Practices describing these uses and your rights. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html?utm_source=openai))

HIPAA also limits disclosures without authorization for specific situations (for example, certain public health reporting or court orders) and requires providers to apply the “minimum necessary” standard when using or sharing PHI beyond treatment. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/45/164.512?utm_source=openai))

Nothing in this guide is legal advice; it’s an educational overview to help you make informed choices and to support discussions with your care team.

HIPAA Security Safeguards

Because dermatology and Mohs records are often stored electronically, the HIPAA Security Rule requires administrative, physical, and technical safeguards to protect ePHI’s confidentiality, integrity, and availability. Risk analysis, workforce training, facility controls, access management, audit controls, and transmission security are core elements. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html?utm_source=openai))

These Electronic Health Record Safeguards typically include strong authentication (for example, role-based access), audit logging, encryption in transit and at rest where reasonable and appropriate, contingency plans with tested backups, and vendor Business Associate Agreements for hosted systems. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/index.html?utm_source=openai))

Patient Rights Under HIPAA

• Access and copies: You can inspect or get copies of your records within 30 days (one 30‑day extension allowed with written notice). Providers may charge only a reasonable, cost‑based fee for your own copies. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html?utm_source=openai))
• Amendments: You may request corrections to inaccurate or incomplete information; the practice must act within 60 days (one 30‑day extension with notice). ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/do-business-associates-have-obligations/index.html?utm_source=openai))
• Accounting of disclosures: You can request a list of certain disclosures made outside treatment, payment, and operations. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/45/164.528?utm_source=openai))
• Restrictions and Patient Confidential Communications: You can ask for limits on sharing and request alternative communication methods or locations (for example, phone calls to your office or letters to a P.O. box). ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/45/164.520?utm_source=openai))
• Notice of Privacy Practices and complaint rights: You must receive a privacy notice and may file complaints with HHS if you believe your rights were violated. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/privacy-practices-for-protected-health-information/index.html?utm_source=openai))

Mississippi Medical Records Access

Under Mississippi’s medical board rules, your medical records are considered the property of the licensee (the provider), but you and your authorized representative have Medical Records Inspection Rights and may obtain copies within a reasonable time after a valid written request. Transfer of records to your current treating provider cannot be withheld due to an unpaid bill, though copy expenses may apply. ([msbml.ms.gov](https://www.msbml.ms.gov/sites/default/files/files/2-2026Administrative%20Code.pdf))

Hospital records must be retained and, upon request, hospitals must provide records of an unemancipated minor to a parent or guardian without the minor’s permission (separate rules may apply to sensitive services). ([law.justia.com](https://law.justia.com/codes/mississippi/2023/title-41/chapter-9/hospital-records-preparation-preservation-and-destruction/section-41-9-69/))

Consent Requirements for Disclosure

Written Consent for Disclosure (a HIPAA Authorization) is generally required for uses or disclosures beyond treatment, payment, and operations—such as most marketing, the sale of PHI, and psychotherapy notes. Authorizations must meet specific content requirements and may be revoked in writing. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/45/164.508?utm_source=openai))

Some disclosures are permitted without authorization, including certain public health reporting and responses to court orders or qualifying subpoenas with required safeguards (for example, notice to the patient or a qualified protective order). Your practice will verify legal requirements before releasing PHI. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/45/164.512?utm_source=openai))

Confidentiality and Security Measures

Your dermatology team uses layered confidentiality controls: staff training and access limits; verification before discussing results; Patient Confidential Communications on request; and “minimum necessary” sharing for non‑treatment purposes. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/may-health-care-providers-leave-messages/index.html?utm_source=openai))

On the technical side, Electronic Health Record Safeguards often include device and media controls, audit trails, and encryption. If a breach of unsecured PHI occurs, HIPAA’s Breach Notification Rule requires notifying affected individuals (and, when applicable, HHS and the media) without unreasonable delay and within 60 days; encryption that meets HHS guidance can qualify as a safe harbor. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html?utm_source=openai))

Medical Records Retention Policies

For Mississippi physicians (including dermatology and Mohs surgery practices), medical records for all new patients—and any patient seen on or after January 1, 2022—must be retained for at least ten years from the date of last treatment. Diagnostic images and similar graphic matter must be kept at least five years. ([msbml.ms.gov](https://www.msbml.ms.gov/sites/default/files/files/2-2026Administrative%20Code.pdf))

Hospitals must retain hospital records a minimum of ten years from the date of discharge; hospital images and similar materials must be kept at least three years (longer if requested in writing). These Medical Records Retention Periods are state‑specific and complement HIPAA’s separate requirement to retain privacy and security compliance documentation for six years. ([law.justia.com](https://law.justia.com/codes/mississippi/2023/title-41/chapter-9/hospital-records-preparation-preservation-and-destruction/section-41-9-69/))

Fees Associated with Medical Records

Mississippi law caps copy charges for patient records requested by patients or their representatives: $20 total for pages 1–20, $1.00 per page for the next 80 pages, and $0.50 per page thereafter; up to 10% of the total may be added for postage/handling, plus $15 if the provider must retrieve records from off‑site archives. ([law.justia.com](https://law.justia.com/codes/mississippi/title-11/chapter-1/section-11-1-52/))

When you request your own records under HIPAA’s Right of Access, the practice must also follow HIPAA’s “reasonable, cost‑based fee” rules (for example, no search/retrieval fees; per‑page fees aren’t permitted for ePHI). Many practices use the optional flat‑fee method of up to $6.50 for standard electronic copies of electronically maintained PHI. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html?utm_source=openai))

Corrections and Amendments Process

If you spot an error in your dermatology or Mohs surgery record, you may submit a written request to amend it. The provider must act within 60 days (with one 30‑day extension if you’re notified in writing). If a request is denied, you can add a brief statement of disagreement that becomes part of your record. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/do-business-associates-have-obligations/index.html?utm_source=openai))

Enforcement and Reporting Procedures

Start with your clinic’s privacy officer to resolve concerns. If you believe your HIPAA rights were violated (for example, delayed access, impermissible disclosure, or improper fees), you may file a complaint with the HHS Office for Civil Rights within 180 days of when you knew or should have known of the issue; OCR can extend this deadline for good cause. ([hhs.gov](https://www.hhs.gov/hipaa/filing-a-complaint/index.html?utm_source=openai))

OCR enforces the Privacy, Security, and Breach Notification Rules. Civil money penalties are set under 45 CFR 160.404 and adjusted annually; outcomes depend on factors like the nature and extent of the violation and whether it was corrected. For concerns about unprofessional conduct (such as refusal to release records), you may also file a complaint with the Mississippi State Board of Medical Licensure. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/45/160.404?utm_source=openai))

Conclusion

Your dermatology and Mohs surgery information is protected by HIPAA and strengthened by Mississippi’s access, consent, retention, and fee rules. Know your rights to access, request Patient Confidential Communications, and seek corrections; expect robust Electronic Health Record Safeguards; and use the outlined reporting paths if problems arise.

FAQs

What rights do patients have under HIPAA for their dermatology records?

You can access and obtain copies of your records within 30 days (with one possible 30‑day extension), request amendments, receive an accounting of certain disclosures, ask for restrictions, request confidential communications, and receive a Notice of Privacy Practices; you can also file a complaint with HHS if needed. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html?utm_source=openai))

How long are Mohs surgery records retained in Mississippi?

Physician practices must keep patient records at least ten years from your last treatment; diagnostic images and similar materials are kept at least five years. Hospitals keep records at least ten years from discharge and certain images at least three years. ([msbml.ms.gov](https://www.msbml.ms.gov/sites/default/files/files/2-2026Administrative%20Code.pdf))

What consent is required to share dermatology medical records?

Your records can be used or shared without authorization for treatment, payment, and operations. Most other disclosures require a HIPAA Authorization, while some (like specific public health reporting or court orders) may occur without it under defined conditions. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html?utm_source=openai))

How can patients correct errors in their medical records?

Submit a written amendment request to your provider. They must respond within 60 days (with one 30‑day extension if they send you written notice). If they deny the request, you can add a statement of disagreement to your record. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/do-business-associates-have-obligations/index.html?utm_source=openai))