Your dental records, without an app

Everything on our Plan Letters page about apps and sits on top of a much older right. You can ask your dental plan, in writing, for what it holds about you, and the plan has 30 days to answer. No app, no portal, no developer registration. This page is that right in plain language: which law gives it to you, who actually holds which record, what the three plans tell their members, what to do when the answer is a shrug or a referral to somebody else, and what the State can and cannot give you.

The two things to keep open

The federal rule, 45 CFR 164.524 The request you can copy

The first link leaves this site for the Code of Federal Regulations. We are not the State, we are not your plan, and nothing here is legal advice.

Start here

Your right came before the socket

Our Plan Letters page is about a . Your plan has had to keep one open since 1 January 2021, so that a health app you choose can plug in and pull your claims, your encounters and the clinical data it holds. From 1 January 2027 it must carry your prior authorizations as well. Finding an app that actually works turned out to be the hard part. What that page does not say loudly enough is that the socket is a door onto a room that has been open far longer.

The room is your right to look at, and get a copy of, the health information your plan holds about you. Federal law wrote it into the Privacy Rule in December 2000. It does not mention apps, portals or sockets. It says a plan must let you ask, and must act within 30 days. The Medicaid managed care rules repeat it as a right of every member, and the State's published contract template for the three plans repeats it again.

So if you never download anything, you have lost nothing. You can ask on paper. This page is how.

Our read, clearly labeled

The app changes the speed and the format. It does not change the entitlement. The claims, the clinical data the plan holds, the encounters and, from 2027, the prior authorizations the socket must carry are all records you can already ask for in writing. The difference is that the paper route comes with a 30 day clock and a federal complaint desk, and the app route, so far, comes with neither a working example nor a plan willing to name one.

The rulebook

The four rules, and who each one binds

Four different laws give you a right to your own records, and each one binds a different party. Ask the wrong party under the wrong law and you get a polite letter explaining that it does not apply. Here is the map.

Binds your plan

45 CFR 164.524, the federal right of access

The Privacy Rule. It binds every health plan and every dentist. The plan may require your request in writing, if it has told you so. It must act within 30 days: hand over the records, or send a written denial that states the reason and how to complain. It may take one extension of up to 30 more days, but only by writing to you before the first 30 run out, with the reason and a date. A fee may cover only the labor of copying, supplies, postage and a summary you agreed to.

45 CFR 164.524(a)(1), (b)(2), (c)(4) and (d)(2).

Binds your plan, again

42 CFR 438.100, Medicaid member rights

The managed care rule. The State must guarantee every member the right to “request and receive a copy of his or her medical records, and request that they be amended or corrected, as specified in 45 CFR 164.524 and 164.526.” The 2025 contract template lists the same right, word for word in one place and in plainer words in the list every member handbook must carry. Exercising it may not change how the plan treats you.

42 CFR 438.100(b)(2)(vi) and (c); 2025 template, Exhibit A14, section 1.1, items 14 and 15 and section 4, item 5.l.6.

Binds your dentist

Health and Safety Code 123110

California's patient records law. It binds dentists and clinics, not plans, and its clocks are shorter. You may inspect your chart within five working days of asking, and copies must be sent within 15 days. Paper copies cost no more than 25 cents a page. A dentist may not hold your records back over an unpaid bill, and a willful violation is unprofessional conduct that the Dental Board can act on. If it comes to court, the judge may award attorney fees to whoever wins.

HSC 123110(a), (b)(1), (h), (i) and (j); HSC 123105(a) for who counts as a health care provider; HSC 123120.

Binds the State

Civil Code 1798.34, the Information Practices Act

The law for state agencies, which includes DHCS. You may inspect what the agency holds about you within 30 days, or 60 days for records in storage, and have an exact copy within 15 days of the inspection, at no more than ten cents a page. The statute says what silence means: “Failure to respond within these time limits shall be deemed denial.” If you sue and win, the court must award your attorney fees.

Civil Code 1798.34(a) and (b); 1798.33; 1798.45(a) and 1798.46(b).

The sentence that does the work

“… an individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set, for as long as the protected health information is maintained in the designated record set …”

45 CFR 164.524(a)(1). The only things carved out are psychotherapy notes and material compiled for a legal proceeding. A dental plan holds neither. Everything turns on the phrase designated record set, which the next section unpacks.

Two laws that do not give you this right, so you do not waste a letter on them. The Confidentiality of Medical Information Act protects your records from other people; its one free copy section expressly does not apply to a Knox-Keene licensed plan. The Knox-Keene Act itself, which licenses all three plans, has no section granting record access at all. The closest it comes is section 1364.5, which requires a plan, on request, to hand you a written statement describing how you can get access to and copies of the medical information it holds. So the two California laws a member might reach for first are the two that do not do the job. The federal rule does.

Civil Code 56.07(c); HSC 1364.5(c)(4). We searched all 32 articles of the Knox-Keene Act for a record access provision and found none.

Naming it

What to ask for, by name

A request for “my records” invites the reply that the plan does not keep your records, your dentist does. That reply is half true. Ask instead for what the rule says a health plan must give you.

What a health plan must give you, in the rule's words

“The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan”

45 CFR 164.501, the definition of a designated record set, item (1)(ii). Read the last four words twice. Maintained by or for. That phrase is the answer to the question in the next section.

Who holds which record, and which clock applies
The record	Who holds it	Rule and clock
Your chart: notes, x-rays, treatment plans, what was done at the chair	Your dentist. All three plans' handbooks say your primary care dentist will “Keep your dental records.”	HSC 123110. Inspect within five working days, copies within 15 days, 25 cents a page.
Enrollment: who you are to the plan, since when, and which dentist you are assigned to	The plan, and any administrator it uses.	45 CFR 164.524. Thirty days.
Claims: every claim your dentist sent, paid or denied, with dates of service, procedure codes and what was paid	The plan, and any administrator it uses.	45 CFR 164.524. Thirty days.
Prior authorizations: the request, the decision, the reason, and the documentation your dentist attached	The plan, and any administrator it uses.	45 CFR 164.524. Thirty days. In an appeal, the whole case file, free, before the decision.
Your grievance and appeal file	The plan.	45 CFR 164.524. Thirty days. The plan must keep a log of every grievance and appeal.
The State's copy: enrollment and disenrollment, what it paid your plan for you, fair hearing papers, and the encounters your plan reports each month	DHCS.	Civil Code 1798.34. Thirty days, by DHCS form 6236. What that gets you is below.

If you want proof that the plans hold these things, use their own forms. Liberty's form for letting somebody else see your file lists what can be released: “Dental records (including x-rays)”, “Pre-treatment authorizations and referrals”, “Claims” and “Provider/dental office assignment information”. DentaQuest's equivalent form offers “Complete claim/authorization history”. Those forms are for authorizing a representative, not for your own request, but they are the plans' own inventory of the file, and they are the categories to name.

Liberty Dental Plan, Authorization to Disclose Protected Health Information, section 3; DentaQuest, Protected Health Information Release Form; Health Net, 2025 Sacramento member handbook, page 33; 2025 template, Exhibit A15, item 15 for the free case file; 42 CFR 438.416 for the log.

In the format you ask for

The plan must give you the information “in the form and format requested by the individual, if it is readily producible in such form and format”. If it keeps the record electronically and you ask for an electronic copy, you get an electronic copy. HHS says mail and email are “generally considered readily producible by all covered entities”, so the plan cannot make you come in to collect.

45 CFR 164.524(c)(2); HHS Office for Civil Rights, access guidance, Form and Format and Manner of Access.

Sent to whoever you say

A signed written request can direct the plan to send the copy straight to another person, for example a new dentist or a lawyer. The same 30 day clock and the same fee limits apply.

45 CFR 164.524(c)(3)(ii).

For a fee that is really a fee

The rule allows “a reasonable, cost-based fee, provided that the fee includes only the cost of” copying labor, supplies, postage, and a summary you agreed to. HHS adds that the fee “may not include costs associated with verification; documentation; searching for and retrieving the PHI; maintaining systems; recouping capital for data access, storage, or infrastructure; or other costs not listed above even if such costs are authorized by State law.” Inspecting in person costs nothing.

45 CFR 164.524(c)(4); HHS access guidance, Fees for Copies.

The question we get asked most

When another company runs your plan

Health Net's dental plan has been administered by DentaQuest since 1 July 2025. California Dental Network does business as DentaQuest. Liberty runs its own. So for two of the three plans, the computer that holds your claims belongs to DentaQuest, and for one of them that name is nowhere on your card. Which company does what is here. The question people write to us with is simple. Who do I ask? And can the administrator keep my record from the plan I am actually enrolled in?

The rule answers both, and it answers them in the plan's disfavor. The federal government's own guidance on the right of access is unusually direct about administrators, which it calls business associates.

1. The plan answers for what its administrator holds

“… if an individual submits a request for access to PHI, the covered entity is responsible for providing the individual with access not only to the PHI it holds but also to the PHI held by one or more of its business associates.”

HHS Office for Civil Rights, Individuals' Right under HIPAA to Access their Health Information, under the question “Does an individual have a right under HIPAA to access PHI about the individual maintained by a business associate of a covered entity?” The answer opens with the word yes. Covered entity means your plan. Business associate means the company it hired.

2. The clock does not restart when the plan forwards your letter

“The 30-day clock starts on the date that the covered entity receives a request for access, so any delay in obtaining the necessary information from a business associate or forwarding the request to the business associate for action ‘uses up’ part of the allotted time.”

Same guidance, under Timelines for Providing Access. The only time the clock starts at the administrator is when the plan's own privacy notice told you to send requests there. None of the three plans' notices does.

3. “Another company has it” is not a lawful reason to say no

“… a covered entity may not deny access because a business associate of the covered entity, rather than the covered entity itself, maintains the PHI requested by the individual …”

Same guidance, under Grounds for Denial. The rule itself adds a duty for the case where the plan genuinely does not hold something: if it knows where the record is, it “must inform the individual where to direct the request for access.” So a plan that says it does not have your file owes you, in the same breath, the name of who does. 45 CFR 164.524(d)(3).

And the administrator is not allowed to hold it back either

The contract between a plan and its administrator is private. We have not seen Health Net's agreement with DentaQuest, and a member cannot. What we can say is what federal law requires that agreement to contain. A business associate contract must provide that the business associate will “Make available protected health information in accordance with § 164.524”. A business associate is separately required to disclose your information “To the covered entity, individual, or individual's designee” as necessary for the plan to meet an electronic copy request. And the plan cannot bill you for having hired somebody: “Administrative and other costs associated with outsourcing the function of responding to individual requests for access cannot be the basis for any fees charged to individuals for providing that access.”

45 CFR 164.504(e)(2)(ii)(E); 45 CFR 164.502(a)(4)(ii); HHS access guidance, question on passing on the costs of outsourcing.

Asked and answered: may the administrator keep it from the plan?

“… a business associate may not deny a covered entity access to the PHI the business associate maintains on behalf of the covered entity if the covered entity needs the PHI to satisfy its obligations under 45 CFR § 164.524.”

HHS Office for Civil Rights, FAQ 2074, which asks whether a business associate may block or terminate a covered entity's access to the records it holds for them. The answer opens with one word: “No.” Blocking is “an impermissible use under the Privacy Rule”, and the office's example is a software vendor that flips a “kill switch” over a payment dispute. Keeping the data available means it is “accessible and usable upon demand by the covered entity”. The one carve-out is where the two companies have agreed the administrator will not hand data back, because its job is to destroy or combine it.

The Medicaid side says the same thing from the other direction. The plan that holds the State contract “maintains ultimate responsibility for adhering to and otherwise fully complying with all terms and conditions of its contract with the State”, whatever it has delegated. The 2025 contract template requires the plan to “oversee and remain responsible and accountable for any functions and responsibilities delegated”, and its business associate addendum with DHCS says plainly: “Business Associate shall make PHI available in accordance with 45 CFR section 164.524.” The template even names the duty in passing, as one the plan keeps whatever else it does: “the duty to respond to Members' requests for their own Protected Health Information (PHI) pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA)”.

42 CFR 438.230(b)(1); 2025 template, Exhibit A8, section 11, Exhibit G, item 11 and Exhibit E, section 25. Each plan's signed contract is not public and can add to the template; nothing in it can subtract from the federal rule.

Why the loop happens anyway

Health Net's 2025 member handbook and its privacy notice do not contain the word DentaQuest. Not once, in either county's edition. The notice covers “Health Net of California, Inc., Health Net Community Solutions, Inc. and Health Net Life Insurance Company” and no other company. The handbook gives a Milwaukee post office box, number 2182, for three different purposes, and DentaQuest's own handbook gives a Milwaukee box with the same number, but nothing on the Health Net side says whose box it is. So a Health Net member whose file sits in DentaQuest's system is told to write to Van Nuys, and nothing in the member's own documents explains the relationship. Van Nuys is the right address. The loop starts when the person answering the phone there says otherwise.

Health Net, Notice of Privacy Practices, effective 1 January 2026, page 1 footnote; 2025 Sacramento and Los Angeles member handbooks, pages 12, 54 and 65; DentaQuest, 2025 Sacramento member handbook, page 12. Searched by machine on 22 September 2026.

Our read, clearly labeled

Write to the company on your card, at the privacy address in its own notice, and nowhere else. The administrator holds the file for the plan; the rule gives it no veto and gives the plan no excuse. If the plan tells you the administrator has it, the correct reply is that the rule makes the plan responsible for records held by its business associates, and that the 30 days began the day the plan received your letter. If the plan tells you it does not hold something and knows who does, it owes you that name in writing. And an administrator may not keep a member's record from the plan the member is enrolled in. That is not our inference; the federal privacy office was asked the question directly and answered it in one word.

In their own words

What each plan tells you

We read the 2025 member handbook and the current privacy notice for each of the three plans, looking for one thing: how a member is told to ask for their records. The table is what we found. Every quotation is verbatim.

How each plan tells a Medi-Cal member to ask for their records, from its 2025 member handbook and its privacy notice, read on 22 September 2026
Plan	The instruction	Deadline it states	Fee it states	Where to send it
Health Net	The handbook lists the right on page 51. Its privacy section, page 57, points to www.hndental.com for the notice and to Member Services at 1-833-493-0428 for a written copy, and gives no address of its own. The notice, effective 1 January 2026, says: “You must make a request in writing to obtain access to your PHI,” and sends every rights request to one place: “If you would like to use any of the following rights, please contact us using the information at the end of this Notice.” That information is in the next column. Neither document mentions DentaQuest.	None.	None stated for copies.	Health Net Privacy Office, Attn: Privacy Official, P.O. Box 9103, Van Nuys, CA 91409. Telephone 1-800-522-0088. Fax 1-833-887-0151. Privacy@healthnet.com. That is the notice's Contact Information section, on page 7, and it is the only one it has. Keep scrolling and the same file ends with a second, separate document, the Financial Information Privacy Notice, under a different address at 21281 Burbank Blvd, Woodland Hills, whose contact line also offers to help with “how to exercise your rights”. Records requests go to Van Nuys.
Liberty Dental Plan	The handbook lists the right on page 53 and, on page 59, gives a web address for the notice. The notice, effective 1 November 2016 and last reviewed 27 April 2023, says: “To inspect or obtain a copy your PHI, you may submit your request in writing to the Privacy Officer.” The notice itself gives no postal address. The separate privacy program page holds the one in the next column.	None.	“If you request a copy, we may charge you a fee for the costs of copying and mailing your records, or other costs associated with your request.”	Privacy Officer, Liberty Dental Plan, 1730 Flight Way, Suite 125, Tustin, CA 92782. Telephone 888-704-9833. Fax 888-273-2718. privacy@libertydentalplan.com.
California Dental Network (DentaQuest)	The handbook lists the right on page 53. Its privacy section, page 59, points to DentaQuest's HIPAA Privacy Policy page, which says “Inspect and copy your health information (fees will apply)” and that such requests “must be in writing”, but carries no address to send them to. DentaQuest's separate Notice of Privacy Practices, effective 16 February 2026, says: “We will provide a copy or a summary of your health and claims records, usually within 30 days of your request,” and is where the address in the next column comes from. Neither page names California Dental Network.	“usually within 30 days” in the notice. None on the page the handbook points to.	“We may charge a reasonable, cost-based fee.” The other page says only that fees will apply.	Attn: Privacy Officer, P.O. Box 2906, Milwaukee, WI 53201-2907, as the notice prints it. Telephone 800-451-1249. privacy@dentaquest.com.

Three things stand out.

All three handbooks state the right in the same sentence, and none says where to send the request. The sentence is “To receive a copy of his or her dental records, and request that they be amended or corrected, as specified in federal regulations.” It comes from the State's model handbook, which is why it is identical. The address sits somewhere behind the privacy notice each handbook tells you to look up online or ask for by phone, and only Health Net's notice carries the instruction and the address in the same document. Liberty's notice names the Privacy Officer and leaves the address to a separate privacy page. The page DentaQuest's handbook sends you to has no address at all; that sits in a different notice elsewhere on the same site. A member holding only the handbook has the right and not the door.

Only one plan states a deadline, and it is the federal one. DentaQuest's notice says usually within 30 days. Health Net's and Liberty's notices state no time at all. The 30 days binds all three regardless; the rule does not depend on a plan choosing to mention it.

Two plans describe fees more broadly than the rule allows. Liberty's notice reserves “other costs associated with your request”. The page DentaQuest's handbook points to says flatly that fees will apply. The federal rule permits only the labor of copying, supplies, postage and an agreed summary, and the federal guidance rules out charging for verification, searching, retrieval or systems. A notice may say what it likes; what a plan may charge is set by the rule. Ask for the fee in writing before anything is sent.

Handbooks: Health Net Sacramento 2025, pages 51 and 57; Liberty 2025, pages 53 and 59; California Dental Network (DentaQuest) Sacramento 2025, pages 53 and 59. Notices: Health Net, pages 6 and 7; Liberty and its privacy program page; DentaQuest Notice of Privacy Practices and HIPAA Privacy Policy. The Los Angeles editions carry the same wording with the Los Angeles phone numbers. The State's requirement that each plan use its model handbook is in the 2025 template, Exhibit A14, section 4.

One more thing to know before you rely on the handbook. California law requires every plan to print a fixed paragraph telling you to call the plan first and then the Department of Managed Health Care, with the plan's own number filled in. In Health Net's 2025 handbook, page 65, and in California Dental Network (DentaQuest)'s, page 67, that paragraph reads “you should first telephone your health plan at (insert health plan's telephone number)”. The placeholder was never replaced. Liberty's handbook filled its numbers in. A member who reaches that paragraph looking for whom to call will find the plan's number elsewhere in the same book; we note it because it is the paragraph the law wrote for exactly that moment.

HSC 1368.02(b); Health Net Sacramento 2025 handbook, page 65; California Dental Network (DentaQuest) Sacramento 2025 handbook, page 67; Liberty 2025 handbook, page 63.

The other door

Can you ask the State instead?

Yes, for what the State holds. And the State says, in its own privacy notice, what it does not hold.

DHCS, on DHCS

“DHCS does not have full copies of your medical records. If you want to look at, get a copy of, or change your medical records, please contact your doctor, dentist, or health plan first.”

DHCS, Notice of Privacy Practices, page 5. The same notice promises a copy of “your health and claims records” usually within 30 days, for a possible reasonable, cost-based fee.

The form, and what it offers

The request goes on form DHCS 6236, now titled Authorization for Release of Protected Health Information, by mail to DHCS/MEDI-CAL FI, P.O. Box 526018, Sacramento, CA 95852-6018, telephone (916) 636-1980. It promises: “You will receive a response to your request within 30 days after we receive your request.” Records up to six years old take about 30 days; older ones about 60. You must specify dates, send a copy of your identification and proof of your address, or have your signature notarized, and if you want to look rather than receive copies, the only reading room is in Sacramento. The form lets you tick these boxes:

“Claim Detail Reports, which contain claims paid by DHCS for services received.”
Medi-Cal eligibility verification printouts.
Treatment or service authorization request screens, meaning the State's own authorization decisions.
Case management records.
Managed care records: enrollment records, disenrollment records, capitation paid to your health plan, and fair hearing documentation.

And, under that list, the instruction that answers the question this section is asking: “Please contact your care provider or managed care plan if you want access to your medical records.”

DHCS, form DHCS 6236 (Rev. 03/24), pages 1, 4 and 5. The State's privacy forms page lists it beside forms for corrections, an accounting of disclosures, and a privacy complaint. DHCS blocks automated checks of its pages, so the page was read from an archive copy and the forms from the State's own file server.

Read against a managed care member, line by line

Every claim. In managed care the plan pays your dentist, and the State pays the plan a monthly amount per member. So “claims paid by DHCS” is not the same thing as your claims. What the State does hold is encounter data. The 2025 template requires every plan to report each service: “Encounter data shall be submitted on at least a monthly basis in a form and manner specified by DHCS”, and “Contractor shall ensure all Encounter Data is submitted to DHCS within two (2) months of receipt of an Encounter.” An encounter is “any single face-to-face dentally related service rendered by a dental Provider(s) to a Member enrolled in the plan during the date of service.” Whether a Claim Detail Report shows a plan member's encounters, the form does not say. We have not tested it.

Service dates. Yes, in the encounter data, if the State will produce it. The definition turns on the date of service, and the State's own fact sheets count members by procedure code from that feed.

Authorization data. The authorization screens on the form are the State's decisions. We can find no requirement in the template that a plan send DHCS its prior authorization decisions as a routine feed; the template makes them available to DHCS on request and at audit. For a plan member, expect that box to contain nothing from your plan.

Clinical notes. No. The State says so twice, once in its notice and once on the form.

What the State does hold for you is the record of your enrollment and disenrollment, what it paid your plan for you each month, any fair hearing file, and the monthly encounter feed. That last one is the item nobody else can give you: the State's copy of what your plan said happened to you.

2025 template, Exhibit A4, section 2, items 2 and 7, and Exhibit E1, definition of Encounter; Exhibit A15, page 174, and Exhibit E, section 22, for records on request; DHCS, fee-for-service and dental managed care fact sheet, February 2026, footnotes 1 and 2.

The State's clock, and what silence means

DHCS is a state agency, so the Information Practices Act applies on top of its own promise. You may inspect within 30 days of the agency receiving your request, or 60 for records in storage, and have an exact copy within 15 days of the inspection. Copy fees may not exceed ten cents a page. If the deadline passes, the statute treats it as a refusal, which is what a lawsuit under the Act is built on, and the court must award your attorney fees if you win. A privacy complaint about DHCS goes on its own form, DHCS 6242, or to the federal Office for Civil Rights.

Civil Code 1798.34, 1798.33, 1798.45 and 1798.46; DHCS, Privacy Complaint Form DHCS 6242.

Fee-for-service is a different desk. Members outside the two managed care counties, and anyone in Sacramento who has been granted a Beneficiary Dental Exception, are in the State's own dental program, where the State is the payer. That program has its own request form and its own box: Medi-Cal Dental, Attn: HIPAA Privacy Contact, P.O. Box 15539, Sacramento, CA 95852-1539, telephone 1-800-322-6384, offering a claim detail report and treatment authorization requests, with a 30 day response. It is the fee-for-service door, the same split we found with the State's approved apps list.

Medi-Cal Dental, Request For Access To Protected Health Information, and the 2025 Medi-Cal Dental Member Handbook, page 39.

Our read, clearly labeled

The State is the wrong door for your record and possibly the right door for one thing. If DHCS will produce a plan member's encounters, and its form neither promises nor rules that out, then a member holding the plan's list of claims and the State's list of encounters can lay them side by side. Where they differ, one of the two organizations has told the other something that is not true. We have not tested it. If you do, tell us what came back.

The data loop

If they stall, ignore you, or pass you around

The loop goes like this. You write to the plan. The plan says the administrator has it. The administrator says it only deals with the plan, or that you are not its member. You are back at the plan, a month older. Here is what the rules say at each point on that circle, and where the exits are.

Day 0. Write to the plan, not the administrator

On paper or by email, dated, to the privacy address in the plan's notice, listed above. Name the categories, as set out above, and cite 45 CFR 164.524. Say how you want it delivered. Keep a copy and a record of the day it arrived. The plan may require writing, may verify who you are, and may ask you to use its form. It may not make you come in, may not require you to use a portal, may not ask why you want it, and “may not impose unreasonable measures on an individual requesting access that serve as barriers to or unreasonably delay the individual from obtaining access.”
Day 30. The answer is due

The rule says the plan “must act on a request for access no later than 30 days after receipt of the request”. Acting means giving you the records, or a written denial in plain language that states the basis and tells you how to complain to the plan and to the federal government. The only other lawful outcome is a letter, sent inside the 30 days, giving a reason for delay and a date, which buys the plan at most 30 more days, once. HHS calls the 30 days “an outer limit” and says plans running electronic systems should be quicker.
Any day. “The administrator has it”

Not a reason. Reply in writing, quoting the guidance in the section above: the plan is responsible for records held by its business associates, the clock started when the plan received your letter, and if the plan does not hold some part of what you asked for, it must tell you where to send that part. Then keep counting from the original date.
Day 60, at the latest. Silence is now reportable

Past 30 days with no extension letter, or past 60 with one, the plan has missed a federal deadline. Every exit below is open, and none of them requires you to give up on the others. Take the federal one first, because it is the desk built for this exact right, and file a grievance with the plan the same day, because that is what starts the State's clocks.

45 CFR 164.524(b)(1), (b)(2) and (d); HHS access guidance, Requiring a Written Request, Verification, Unreasonable Measures, and Timeliness in Providing Access.

Where the exits are

Federal, and specific to this right

HHS Office for Civil Rights

The office that enforces the right of access, against plans and business associates alike. A complaint must be in writing, through the portal, by mail, fax or email; must name the plan; must describe what happened; and must “Be filed within 180 days of when you knew that the act or omission complained of occurred.” The office can extend that for good cause. The law forbids the plan from retaliating against you for filing. Since 2019 the office has run a Right of Access Initiative; its first settlement under it came in September 2019 and its 55th was announced on 27 August 2026.

1-800-368-1019TDD 1-800-537-7697

OCR Complaint Portal; complaint process; by mail to Centralized Case Management Operations, U.S. Department of Health and Human Services, 200 Independence Avenue, S.W., Room 509F HHH Bldg., Washington, D.C. 20201, or OCRComplaint@hhs.gov; 45 CFR 160.306; HHS press releases of 9 September 2019 and 27 August 2026.

The plan's own system

A grievance, filed the same day

An unanswered records request is a grievance whether or not you use the word. State regulation defines a grievance as any written or oral expression of dissatisfaction, and adds: “Where the plan is unable to distinguish between a grievance and an inquiry, it shall be considered a grievance.” You have at least 180 days to file. The plan must acknowledge in writing within five calendar days, naming a person, and resolve within 30 calendar days with a clear explanation. Every grievance goes in a log the State reviews.

28 CCR 1300.68(a)(1) and (b)(9); HSC 1368(a)(4) and 1368.01(a); 2025 template, Exhibit A15, pages 170 to 171 and 187. The grievance route, step by step.

The plan's regulator

DMHC Help Center

All three plans are licensed by the Department of Managed Health Care, and DHCS's own plan directory sends unresolved grievances there. The Help Center takes a complaint once you have been in the plan's grievance process for 30 days, or, in its words, “if you have not received your Health Plan's decision within 30 days”, and at once if there is a serious threat to your health. A records dispute is not a medical necessity dispute, so do not expect an Independent Medical Review; expect a complaint file the plan has to answer.

1-888-466-2219TDD 1-877-688-9891

DMHC, File a Complaint, and the online form; Helpline@dmhc.ca.gov; HSC 1368(b)(1)(A); DHCS, DMC Dental Plan Directory. DMHC blocks automated checks, so its pages were read from archive copies.

The State's contract holder

DHCS Ombudsman, and a free lawyer

The Medi-Cal Managed Care and Mental Health Office of the Ombudsman “Helps solve problems between Medi-Cal managed care members and managed care plans”. It says of itself that it does not conduct formal investigations, so treat it as a lever, not a verdict. The State's contact page for dental managed care members lists no DHCS complaint line of its own. For help that can actually take the case, the Health Consumer Alliance gives free legal help in any language, regardless of income, and is funded in part by DMHC and DHCS.

1-888-452-8609Ombudsman, weekdays 8 to 5

1-888-804-3536Health Consumer Alliance

DHCS, Office of the Ombudsman, MMCDOmbudsmanOffice@dhcs.ca.gov; DHCS, DMC Member Contact Information; Health Consumer Alliance.

For your dentist's chart

The Dental Board, and the court

The Board's own answer to the question is short: “Under Health and Safety Code section 123110, the dentist is required to provide you with a copy of the records. There may be a cost for duplication.” A willful refusal is unprofessional conduct, and the Board takes complaints online or on its form ENF-10. Separately, the patient may sue to enforce the section, and the court may award attorney fees to the prevailing party, which cuts both ways.

(916) 263-2300Dental Board of California

Dental Board of California, Consumer FAQ, and Consumer Complaint Form ENF-10; HSC 123110(h); HSC 123120.

For the State's own file

The Information Practices Act

If DHCS lets its 30 days pass, the statute deems your request denied, and section 1798.45 lets you bring a civil action for refusing a lawful request to inspect, with attorney fees assessed against the agency if you prevail. Before that, the same privacy complaint form and the same federal office apply to DHCS as to a plan, because DHCS is a covered entity too.

Civil Code 1798.45(a) and 1798.46; DHCS, form DHCS 6242.

Which company to write to, plan by plan. Health Net members write to Health Net's privacy office in Van Nuys, because Health Net's notice is the one that governs them and Health Net's own staff are the ones its administrator's manual says are not delegated. California Dental Network (DentaQuest) members write to the DentaQuest privacy officer, because that is the notice their handbook points at. Liberty members write to Tustin. A letter sent to the other company in the pair is the first lap of the loop.

Words you can use

A request that is hard to ignore

General information, not legal advice, and not a form any plan has approved. It is a plain letter that says what the rule says, so that the reply has to engage with the rule.

Who you are. Your full name, date of birth, the member number on your card, and the plan's name exactly as the card prints it. Your address, and an email if you want the copy by email.
What you are asking for. A copy of the protected health information the plan holds about you in its designated record set, then the categories by name: enrollment and dentist assignment; every claim submitted for you, paid or denied, with dates of service, procedure codes and amounts; every prior authorization request and decision, with the reason and the documentation submitted; case management notes; and your grievance and appeal file. Give a date range, or say all dates.
Under what. 45 CFR 164.524. If you are a Medi-Cal member, add 42 CFR 438.100(b)(2)(vi). One line each; you are not writing a brief.
In what form. Electronic, by email or on a disc, or on paper by mail. Say which. If the plan says a format is not readily producible, it must offer a readable one.
About the fee. That you understand a reasonable, cost-based fee for copying may apply, and you want the amount in writing before anything is sent. That inspecting the records costs nothing.
About the administrator. That if any part of this is held by an administrator or other business associate acting for the plan, you understand the plan remains responsible for providing it, and that the 30 days run from the plan's receipt of this letter.
About what the plan does not hold. That if the plan does not hold any part of this and knows who does, you are asking it to tell you in writing where to direct that part.
About a denial. That any denial, in whole or in part, should come as the written denial the rule requires, with the basis and how to complain.
The date. On the letter, and in your own notes the day it arrived. Put day 30 on a calendar.

What they may ask of you, and what they may not. They may ask you to put it in writing, if their notice says so, and all three do in one form or another. They may ask for proof of who you are, and the rule requires them to check, so long as the checking does not become the delay. They may hand you their own form to fill in. They may not make you come in person, may not require you to use a portal, may not ask why you want your own records, and may not charge you for the time it takes to find them. If a reply asks for any of those, quote the guidance back and keep the day count running.

45 CFR 164.524(b)(1); HHS access guidance, Requiring a Written Request, Verification, Unreasonable Measures, Grounds for Denial and Fees for Copies.

Being honest about it

What we still do not know

Whether DHCS will give a plan member their encounters. Its form offers claims paid by DHCS, and in managed care DHCS pays the plan, not the dentist. Nothing on the form says whether the monthly encounter feed comes back on a Claim Detail Report. We have not sent one in. If you have, we would like to see what arrived, with your details removed.
Whether any of the three plans answers inside 30 days in practice. Nobody publishes that number. The federal enforcement record shows that plans and providers do miss it; it does not tell us about these three.
What the member portals actually show. Each plan's portal is a login screen to us. The public descriptions promise claims history and, for Liberty, treatment history. Whether a member can pull the prior authorization file or the documentation attached to it without writing a letter, we cannot say.
Whether the fee language is ever applied. Two notices describe fees more broadly than the rule allows. Whether a member has actually been charged for searching, retrieval or anything beyond copying, we do not know.
What the State's form change means. DHCS 6236 was called Request for Access to Protected Health Information in its 2016 edition and Authorization for Release of Protected Health Information in the 2024 one. The request instructions read the same. Whether the retitling changed anything for a member asking for their own file is not explained anywhere we can find.
Whether 30 days becomes 15. In 2021 the federal government proposed cutting the deadline to 15 days. It has not done so. The regulatory agenda now lists a separate proposal on response times, expected in November 2026. Until a final rule is published, the number is 30.

If a plan or its administrator sent you in a circle, we would like to see the letters, in order, with your details blacked out. Dates matter more than names. Send them here.

Read it yourself

Sources

Every quotation on this page was checked by machine against the text of the document it came from, on 22 September 2026. Where a site blocks automated reading, the note says how we read it.

45 CFR 164.524, access of individuals to protected health information: (a)(1) the right and its two exceptions, (b)(1) written requests, (b)(2) the 30 days and the single extension, (c)(2) form and format, (c)(3) mailing and sending to a third party, (c)(4) fees, (d) written denials, and (d)(3) the duty to say where a record is. 45 CFR 164.501 for the definition of designated record set. 45 CFR 164.504(e)(2)(ii)(E) and 164.502(a)(4)(ii) for what a business associate must do. 45 CFR 160.306 for complaints to the Secretary and the 180 days. The eCFR was current to 18 September 2026 when read; the last amendment to 164.524 is dated 6 February 2014.
HHS Office for Civil Rights, Individuals' Right under HIPAA to Access their Health Information 45 CFR § 164.524, content last reviewed 30 May 2025. Quoted for business associates, the 30 day clock, verification, unreasonable measures, form and format, fees, and denials. HHS has taken this page down. It was live at that address when we captured it on 27 March 2026, and by 29 May 2026 the address returned the department's Page Not Found template. The current HIPAA Guidance Materials index no longer lists it, and we found no replacement anywhere on hhs.gov. Our links therefore point at the Internet Archive copy of 27 March 2026, which is where every quotation above was taken from. The guidance explained the rule; the rule itself, quoted throughout this page, is unchanged and still in force.
HHS Office for Civil Rights, FAQ 2074, on whether a business associate may block or terminate a covered entity's access to the protected health information it holds for them. Quoted from an Internet Archive capture of the same page; the wording is identical in captures from 2017 and 2024, and the HHS Guidance Portal lists it as issued by the Office for Civil Rights and published 18 December 2024.
HHS Office for Civil Rights, HIPAA Complaint Process, read from an archive capture of 15 September 2026, and the Health Information Privacy Complaint form package for the telephone and TDD numbers. HHS press releases OCR Settles First Case in HIPAA Right of Access Initiative, 9 September 2019, and HHS OCR Settles HIPAA Investigation with Azul Vision, 27 August 2026, for the count of 55 enforcement actions.
42 CFR 438.100, enrollee rights, paragraph (b)(2)(vi) for records and (c) for free exercise; 42 CFR 438.230(b)(1) for the plan's responsibility for subcontractors; 42 CFR 438.10(g)(2)(ix) for the handbook having to list the rights; 42 CFR 438.416 for grievance and appeal records.
DHCS, Dental Managed Care boilerplate contract, 2025, by PDF page: Exhibit A14 section 1.1 items 9, 14 and 15 (page 155) and section 4 item 5.l (pages 162 to 163) for member rights; Exhibit A8 section 11 (page 105) for delegation; Exhibit A4 section 2 (pages 51 to 52) and Exhibit E1 (page 302) for encounter data; Exhibit A15 (pages 170 to 171 and 187) for grievance clocks and the free case file; Exhibit E sections 22 and 25 (pages 285 and 291); Exhibit G item 11 (page 319). This is the published template. Each plan's signed contract is not public.
California Health and Safety Code 123100, 123105, 123110 and 123120, patient access to health records. Section 123105(a) lists who is a health care provider; a dentist is item (6) and no plan is on the list. Civil Code 56.07 and 56.10, the Confidentiality of Medical Information Act. Health and Safety Code 1364.5, 1368, 1368.01 and 1368.02, the Knox-Keene Act; every article of the Act was fetched and searched for a record access provision. 28 CCR 1300.68, grievance systems.
California Civil Code 1798.34, 1798.33, 1798.45 and 1798.46, the Information Practices Act of 1977.
DHCS, Notice of Privacy Practices, Pub 391 (3/21), effective 23 September 2013, pages 1, 2 and 5; form DHCS 6236 (Rev. 03/24); form DHCS 6242; the Privacy Forms page, read from an archive capture of 12 July 2026; the Office of the Ombudsman page, read from an archive capture of 20 September 2026; the fee-for-service and dental managed care fact sheet, February 2026. DHCS's web pages return a bot wall to automated readers; its file server does not.
Medi-Cal Dental, DMC Member Contact Information and DMC Dental Plan Directory, read live; Request For Access To Protected Health Information and the 2025 Medi-Cal Dental Member Handbook, pages 38 to 39, for the fee-for-service desk.
Health Net, Notice of Privacy Practices, effective 1 January 2026, revised 13 March 2026; Sacramento and Los Angeles 2025 member handbooks; and its provider manual, effective 1 July 2025, page 10, for DentaQuest administering the plan.
Liberty Dental Plan, HIPAA Notice of Privacy Practices, effective 1 November 2016, last reviewed 27 April 2023; Privacy program page for the Tustin address; 2025 member handbook for Los Angeles and Sacramento; Authorization to Disclose Protected Health Information.
DentaQuest, Notice of Privacy Practices, effective 16 February 2026; HIPAA Privacy Policy; Sacramento and Los Angeles 2025 member handbooks for California Dental Network (DentaQuest); Protected Health Information Release Form.
Department of Managed Health Care, File a Complaint and Contact Us, read from archive captures of 8 September and 24 June 2026 because the department blocks automated readers. Dental Board of California, Consumer FAQs and form ENF-10, read live. Health Consumer Alliance.
Federal Register, Proposed Modifications to the HIPAA Privacy Rule, 21 January 2021, for the 15 day proposal; Unified Agenda entries RIN 0945-AA00 and RIN 0945-AA28 for where it stands.

Did a plan send you in a circle?

The letter you sent, the reply, the referral to the other company, the second reply. In order, with your details blacked out. We publish patterns, never people.

Send it in