Dental office compliance comes down to a short list of repeating tasks. Every sterilizer load gets a mechanical and chemical check, every sterilizer gets a spore test at least weekly, and each exposed employee gets bloodborne pathogens training within one year of their last session. The exposure control plan is reviewed at least once a year.
The rest happens at hire or after an event: the hepatitis B vaccine offer within 10 working days, a breach notice within 60 days, or a report to OSHA within 8 or 24 hours. Print the free calendar below and initial each month as you go.
Dental office compliance tasks at a glance
| How often | Task | Rule |
|---|---|---|
| Every load | Check time, temperature and pressure; check the chemical indicator in every package | CDC |
| Every patient | Run water and air through handpieces and air/water syringes for 20 to 30 seconds | CDC |
| Weekly | Spore test each sterilizer | CDC, and law in some states |
| Weekly | Activate plumbed eyewash stations | ANSI Z358.1 (guidance) |
| On the manufacturer's schedule | Treat and monitor dental unit waterlines | CDC |
| Monthly | Visual check of fire extinguishers | 29 CFR 1910.157(e)(2) |
| Yearly | Bloodborne pathogens training, per person | 29 CFR 1910.1030(g)(2) |
| Yearly | Review and update the exposure control plan | 29 CFR 1910.1030(c)(1)(iv) |
| Yearly | Fire extinguisher maintenance check | 29 CFR 1910.157(e)(3) |
| Yearly, by 60 days after year end | Report last year's small breaches to HHS | 45 CFR 164.408(c) |
| At hire | Bloodborne pathogens, hazard communication and PPE training; hepatitis B vaccine offer; HIPAA training | 1910.1030, 1910.1200, 1910.132, 45 CFR 164.530(b) |
| After an event | Exposure incident follow-up, breach notices, OSHA serious injury reports | 1910.1030(f), 45 CFR 164.404, 29 CFR 1904.39 |
"CDC" means a CDC recommendation. It becomes a legal requirement when your state dental board adopts it, and many have.
Every load and every patient
Sterilizer loads. CDC recommends noting the time, temperature and pressure for each load and placing a chemical indicator inside each package. If the cycle didn't reach the manufacturer's settings or an indicator didn't change, don't use the package. Write it on your autoclave log sheet.
Dental unit waterlines. CDC recommends running water and air through any device connected to the dental water system that enters the patient's mouth (handpieces, ultrasonic scalers, air/water syringes) for at least 20 to 30 seconds after each patient.
Weekly dental compliance tasks
Spore test each sterilizer. CDC recommends "the periodic use (at least weekly)" of a biological indicator, plus a spore test with every load that holds an implantable device. Several states make weekly testing law. California's 16 CCR 1005 requires weekly spore tests and keeping the results for 12 months.
Activate plumbed eyewash stations. OSHA requires "suitable facilities for quick drenching or flushing of the eyes" where employees may be exposed to corrosive materials (29 CFR 1910.151(c)). OSHA has not adopted ANSI Z358.1 but uses it as guidance. ANSI Z358.1 calls for activating plumbed eyewash units weekly to flush the line and confirm they work.
Monthly dental compliance tasks
- Fire extinguishers. OSHA requires a visual inspection every month (29 CFR 1910.157(e)(2)). Initial and date the tag.
- Waterline monitoring. CDC says to treat waterlines so the water meets the drinking water standard of under 500 CFU/mL, and to ask the unit's manufacturer how and how often to monitor. Your state may set its own schedule.
- Sharps containers and supplies. Replace sharps containers before they are overfilled (1910.1030(d)(4)(iii)(A)) and restock PPE so it stays readily accessible. This isn't a fixed monthly rule, but a monthly walk-through catches it.
Yearly dental compliance tasks
OSHA
- Bloodborne pathogens training for each exposed employee. OSHA requires it "within one year of their previous training" (1910.1030(g)(2)(iv)). Track each person's own due date rather than training everyone in one month. See OSHA training for dental offices.
- Exposure control plan review. The plan must be "reviewed and updated at least annually and whenever necessary" (1910.1030(c)(1)(iv)). The review must document that you considered safer sharps devices that are on the market, and must record input from non-managerial staff who give patient care (1910.1030(c)(1)(v)). Use the exposure control plan template if you don't have one.
- Fire extinguisher maintenance check. Once a year (1910.157(e)(3)), usually done by a service company that tags each unit. If staff are expected to use extinguishers, train them at hire and at least once a year (1910.157(g)(2)).
Dental offices (NAICS 6212) are partially exempt from the OSHA 300 injury log, so there is no 300A summary to post each February unless OSHA or the Bureau of Labor Statistics asks you in writing to keep the log.
HIPAA
- Small breach report to HHS. Breaches affecting fewer than 500 people are logged and reported to HHS "not later than 60 days after the end of each calendar year" (45 CFR 164.408(c)). That is March 1, or February 29 in a leap year.
- Security risk analysis. HIPAA requires "an accurate and thorough assessment" of risks to electronic patient information (45 CFR 164.308(a)(1)(ii)(A)) and periodic evaluations when your systems or operations change (164.308(a)(8)). There is no federal yearly deadline. Reviewing it every year, and whenever you change software, hardware or storage, keeps it current.
- Policy review. HIPAA requires you to review documentation "periodically" and update it as needed (45 CFR 164.316(b)(2)(iii)). Most offices do this with the risk analysis.
- HIPAA training refresher. Not a fixed federal yearly rule (see below), but most offices train everyone yearly.
When a new employee starts
- Bloodborne pathogens training before they begin tasks with exposure to blood or saliva (1910.1030(g)(2)(ii)(A)).
- Hepatitis B vaccine offered free, after the training and within 10 working days of their first assignment to those tasks (1910.1030(f)(2)(i)). If they decline, they sign the hepatitis B vaccine declination form.
- Hazard communication training at the time of initial assignment (1910.1200(h)(1)).
- PPE training before they do work that needs PPE (1910.132(f)).
- HIPAA training within a reasonable period after they join (45 CFR 164.530(b)(2)(i)(B)).
After an incident or a change
| Event | What to do | Deadline | Rule |
|---|---|---|---|
| Needlestick or other exposure incident | Offer a confidential medical evaluation and follow-up at no cost; give the employee the healthcare professional's written opinion | Evaluation right away; written opinion within 15 days of the evaluation | 1910.1030(f)(3), (f)(5) |
| Tasks or procedures change | Extra bloodborne pathogens training on the new exposure; update the exposure control plan | When the change happens | 1910.1030(g)(2)(v), (c)(1)(iv) |
| New hazardous chemical | Get its safety data sheet, add it to the chemical list, train staff on the new hazard | When it arrives | 1910.1200(h)(1) |
| Work-related death | Report to OSHA | Within 8 hours | 29 CFR 1904.39 |
| In-patient hospitalization, amputation or loss of an eye | Report to OSHA | Within 24 hours | 29 CFR 1904.39 |
| HIPAA breach of unsecured patient information | Notify each affected patient | Without unreasonable delay, no later than 60 calendar days after discovery | 45 CFR 164.404(b) |
| Breach affecting 500 or more people | Notify HHS at the same time as patients, and the media if more than 500 residents of one state are affected | Same 60-day limit | 45 CFR 164.406, 164.408(b) |
| Positive spore test | Take the sterilizer out of service and retest | Right away | CDC |
How long to keep dental compliance records
| Record | Keep for | Rule |
|---|---|---|
| Bloodborne pathogens training records | 3 years from the training date | 1910.1030(h)(2)(ii) |
| Employee medical records (hepatitis B status, exposure follow-up) | Length of employment plus 30 years | 1910.1030(h)(1)(iv) |
| HIPAA policies, risk analysis and required documentation | 6 years from creation or when last in effect, whichever is later | 45 CFR 164.316(b)(2)(i), 164.530(j)(2) |
| Sterilization and spore test records | As long as your state requires | CDC; California: 12 months |
The printable dental compliance calendar
The free PDF has two landscape pages:
- Compliance calendar. Recurring and yearly tasks with a box for each month. Initial the box once the month's checks are done and logged.
- Staff training due dates. One row per person: start date, hepatitis B offer, and the date each person's bloodborne pathogens training is next due.
Dental office compliance calendar
complyday.comRecurring tasks: initial the month once its checks are done and logged
| Task | How often | Rule | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mechanical check and chemical indicators, every sterilizer load (cycle log) | Every load | CDC | ||||||||||||
| Spore test, each sterilizer | At least weekly | CDC; state rules | ||||||||||||
| Flush dental unit water and air lines after each patient, 20 to 30 seconds | Every patient | CDC | ||||||||||||
| Treat and test dental unit waterlines (target under 500 CFU/mL) | Manufacturer schedule | CDC | ||||||||||||
| Activate plumbed eyewash stations | Weekly | ANSI Z358.1 | ||||||||||||
| Visual check of fire extinguishers | Monthly | 1910.157(e)(2) | ||||||||||||
| Sharps containers replaced before they are overfilled | As needed | 1910.1030(d)(4) | ||||||||||||
| New chemicals: safety data sheet on file, chemical list updated | As needed | 1910.1200 |
Yearly tasks: initial the month you do it
| Task | How often | Rule | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Exposure control plan reviewed and updated | At least annually | 1910.1030(c)(1)(iv) | ||||||||||||
| Safer sharps devices considered and documented | Annually | 1910.1030(c)(1)(iv)(B) | ||||||||||||
| Input from non-managerial clinical staff documented | With the review | 1910.1030(c)(1)(v) | ||||||||||||
| Fire extinguisher maintenance check | Annually | 1910.157(e)(3) | ||||||||||||
| Fire extinguisher training (if staff are expected to use them) | Annually | 1910.157(g)(2) | ||||||||||||
| HHS report of breaches under 500 people from last year | Within 60 days after year end | 45 CFR 164.408(c) | ||||||||||||
| HIPAA security risk analysis reviewed and kept current | Periodically; most offices yearly | 45 CFR 164.308 | ||||||||||||
| HIPAA training refresher | Common practice yearly | 45 CFR 164.530(b) |
Federal OSHA, CDC and HIPAA rules. ANSI Z358.1 is a consensus standard OSHA uses as guidance. If your state runs an OSHA State Plan or its dental board sets its own rules (for example, California requires weekly spore tests and keeping results 12 months), follow the stricter rule.
Open the printable version or use the download button.
Dental office compliance checklist vs. calendar
The calendar tells you when tasks are due. The dental OSHA compliance checklist tells you what has to be in place at any time: the written plans, labels, sharps containers, safety data sheets and posters. Use the checklist once to find gaps, then the calendar to keep up. For HIPAA, see HIPAA compliance for dental offices.
State rules
Federal OSHA rules are the minimum. In the 22 states with an OSHA State Plan covering private employers, the state's rule applies and can be stricter. State dental boards often add infection control rules, such as weekly spore testing, waterline standards or record retention periods. Check your state dental board's infection control regulation and add its tasks to the calendar.
ComplyDay tracks these dates for you. It emails the right person a month before each task is due, shows which staff are current on every course, and turns your records into an inspection binder. See OSHA and HIPAA training for dental offices for plans and pricing.