Dental Records, Consent Forms and X-Ray Storage: An Owner's Checklist

A patient you treated three years ago sends a legal notice about a crown. Your lawyer asks for four things: the signed consent form, the treatment notes from each visit, the X-rays taken at the start and at the end, and the WhatsApp messages you exchanged.

How many of those could you find in the next hour?

In many dental clinics, the honest answer is "some". The consent form is in a cupboard somewhere. The X-rays are on the old computer that crashed. The notes say "RCT done". The messages are on an assistant's personal phone, and she left last year.

Records and consent aren't the exciting part of running a dental practice. They're the part that protects everything else. Here's a practical checklist for owners. It's not legal advice. Use it to get organised, then confirm the details with a lawyer.

What consent forms does a dental clinic need?

A written consent form for each type of procedure you do, not one general form for everything.

• Procedure-specific forms for extractions, root canals, implants, crowns and bridges, orthodontics, cosmetic work and anything involving sedation or surgery.
• Plain language, in a language the patient reads comfortably. A Hindi-speaking patient signing an English-only form hasn't really understood it.
• The conversation recorded, not just the signature. A short note in the file: what was explained, which options were discussed, what questions the patient asked.
• Signed before treatment starts, dated, and filed with the patient record.
• For minors, signed by a parent or guardian.
• Separate consent for clinical photographs, used only for the patient's clinical record and care, never for promotion.

Have your lawyer check your forms and confirm what each one must include for your situation.

What should dental treatment notes include?

Notes should let another dentist understand exactly what happened, years later. "RCT done" doesn't.

Set a standard format for every visit:

1. Date, time and treating dentist.
2. Patient's complaint in their own words.
3. Findings, including any X-rays or scans taken.
4. Diagnosis and the options discussed.
5. What the patient chose, and that consent was taken.
6. Treatment done, materials used and any lab work sent.
7. Instructions given to the patient.
8. Next appointment and plan.

Templates in your practice software help here. The dentist fills in the gaps rather than writing from scratch, and every note looks the same.

How should X-rays, OPGs, CBCT and scans be stored?

This is where most dental clinics are weakest. Images pile up on whatever computer is attached to the machine.

Some practical rules:

• Back up every day, to a second place, and test that you can actually restore a file. A backup you've never restored is a hope, not a backup.
• Link every image to the patient's record, so nobody searches folders by date.
• Keep X-ray equipment licences and approvals current, and put renewal dates in your compliance calendar.

Who should be allowed to access patient records?

Only those who need them, for their job.

• Dentists and assistants: clinical records for the patients they treat.
• Front desk: contact and booking details, not full clinical notes.
• Visiting consultants: the patients they're treating in your clinic.
• Labs: only the scans and details needed for the case.

Give each person their own login. Remove access the day someone leaves. Shared passwords on a sticky note at reception are how patient data walks out of the door.

How should records be shared with patients, labs and other dentists?

• With the patient's consent, recorded in the file.
• Through official channels: your clinic's WhatsApp business account, email or practice software. Never from a staff member's personal phone.
• Only what's needed. A lab needs the scan, not the medical history.
• Patients asking for their own records should get them in a reasonable time. Ask your lawyer about the process and timelines.

India's data protection law applies to patient information. Ask your lawyer what it means for how you collect, store and share data, and whether your software and messaging vendors meet those duties.

What goes in the owner's compliance calendar?

One calendar, owned by your practice manager, with a reminder sixty days before every renewal.

1. Clinical establishment registration, where it applies.
2. X-ray and imaging equipment licences and approvals.
3. Bio-medical waste authorisation and disposal agreement.
4. Professional indemnity insurance for every dentist.
5. Fire safety and other premises approvals.
6. Annual review of consent forms with your lawyer.
7. Quarterly check that backups restore properly.
8. Staff access review: who has access to what, and who has left.

Most compliance problems aren't caused by bad intentions. They're caused by forgotten dates.

What should you ask your lawyer?

Take this list to your meeting:

• How long must we keep records, X-rays and consent forms?
• Are our consent forms complete for each procedure?
• What do we need for minors and elderly patients?
• How should we handle patient requests for records?
• What does India's data protection law require of us and our vendors?
• What should our contracts with labs, software vendors and visiting dentists say about patient data?

This list draws on the compliance chapter of Rich Doctors Walk Away. We help dental owners set up the software, access rules and WhatsApp side through our CRM and automation work, and the wider owner systems through growth consulting. The rest of the owner's toolkit for dental clinics is on our dental page.

The short version

• Use procedure-specific consent forms in plain language, and record the conversation.
• Write treatment notes in a standard format another dentist could follow years later.
• Link every X-ray and scan to the patient record, back up daily and test restores.
• Give access only to those who need it, share through official channels with consent.
• Keep one compliance calendar and confirm retention, consent and data duties with a lawyer.