HIPAA training for dental offices: who, what and how often

HIPAA training requirements for dental offices

Two parts of HIPAA require training:

The Privacy Rule says training must be given "as necessary and appropriate for the members of the workforce to carry out their functions." A hygienist and a billing coordinator can get different detail, but both need training.

Who needs HIPAA training in a dental office

HIPAA defines the workforce as employees, volunteers, trainees and other people whose work for the office is under its direct control, whether or not they are paid. In a dental office that means:

• dentists, including the owner and associates,
• hygienists and dental assistants,
• front desk, scheduling and billing staff,
• the office manager,
• students and trainees doing rotations, and
• temporary staff who work under your direction.

Vendors who handle patient information for you, such as your IT company or billing service, are business associates. They train their own people. You need a business associate agreement with them, which is covered in HIPAA compliance for dental offices.

What dental HIPAA training should cover

The rules require training on your policies, so the content follows your written policies. For most dental offices that includes:

Privacy

• What protected health information is: anything that identifies a patient and relates to their care or payment, including x-rays, charts, appointment lists and billing records.
• Your Notice of Privacy Practices: giving it at the first visit, asking for a signed acknowledgment, and posting it in the office and on your website.
• Patient rights: getting copies of records (act within 30 days), asking for corrections, asking for confidential communications, and asking for restrictions.
• Minimum necessary: using and sharing only what's needed, except when sharing with another provider for treatment.
• Talking with family members and friends: when you can share information with someone involved in a patient's care, and when to ask the patient first.
• The front desk: sign-in sheets, phone calls, voicemail and what can be seen on screens.
• Who your privacy officer is, and how patients can file a complaint.
• The sanctions your office applies when someone breaks the policies. HIPAA requires you to have and apply them.

Security

The Security Rule lists four topics for its training program. Each is "addressable," which means you use it where it's reasonable and appropriate, or document why not:

• Security reminders: periodic security updates.
• Protection from malicious software: how to spot and report phishing emails, bad links and suspicious attachments.
• Log-in monitoring: watching for and reporting failed or odd log-ins.
• Password management: creating, changing and protecting passwords.

Incidents and breaches

• How to report a lost phone, a misdirected email or a record sent to the wrong patient, and who to report it to.
• That the office, not the staff member, decides whether it's a breach that needs notification.

How often is HIPAA training required?

The rules require training:

1. For new staff within a reasonable period after they join. Training in the first week, before they access the practice management system on their own, is a simple standard to set.
2. After a material change in your policies, for the staff whose work it affects, within a reasonable period after the change takes effect.
3. On an ongoing basis for security awareness. A periodic security reminder is one of the listed topics.

There is no yearly date in the HIPAA rules. Training everyone once a year is a common practice, not a legal requirement. It is easy to track and gives you a clean record. Many offices do it at the same time as their yearly OSHA training for dental offices.

HHS published a proposed update to the Security Rule in January 2025. A proposed rule is not in force. We'll update this page if a final rule changes the training requirements.

Online HIPAA training for dental offices

Online training is allowed. HIPAA doesn't set a format, a length or a list of approved providers. An online course meets the rules when:

• it covers your office's own policies, not only HIPAA in general,
• it fits each person's job, and
• you can show who completed it and when.

A generic video plus a 15 minute review of your own policies at a staff meeting is one way to cover both. Record both.

Free HIPAA training for dental offices

You can run HIPAA training yourself at no cost. You need your written policies, an agenda built from the topics above, and a sign-in sheet. The training is valid if it covers what each person needs for their job and you document it. What you lose by doing it yourself is time: writing the material, chasing new hires and keeping track of who is due.

How to document HIPAA training

For each session, record:

• the date,
• the topics covered, or a copy of the material,
• who gave the training, and
• the name and job title of each person who attended, with their signature or completion record.

Keep these records for 6 years from the date they were created or last in effect, whichever is later.

Steps to run your dental HIPAA training

1. Make sure your privacy and security policies are written and current. Training follows the policies.
2. Build the agenda from the topics above, and add anything specific to your office, such as your texting rules.
3. Train new hires in their first days, before they work with patient records alone.
4. Train the full team once a year, and after any material policy change.
5. Send short security reminders during the year, such as a phishing example.
6. Record the date, topics, trainer and attendees, and file it for 6 years.

Related HIPAA records

• The patient forms your staff will hand out are in free HIPAA forms for dental offices.
• The full list of HIPAA tasks is in the HIPAA compliance guide for dental offices.
• ComplyDay covers both sides with OSHA and HIPAA training for dental offices in one plan.