HIPAA compliance for dental offices means having a named privacy and security officer, a Notice of Privacy Practices, written policies, a security risk analysis, staff training, business associate agreements with vendors that handle patient data, and a plan for breaches. It applies to any dental office that files insurance claims or checks eligibility electronically.
Keep every HIPAA document for 6 years. The checklist below covers each item.
Does HIPAA apply to your dental office?
HIPAA applies to "covered entities." A dental office is one if it transmits health information electronically in connection with a standard transaction, such as sending insurance claims, checking eligibility or receiving payment information. Almost every office that bills dental insurance does this, directly or through a clearinghouse.
An office that never transmits health information electronically is not a covered entity. State privacy and data breach laws may still apply.
The three HIPAA rules
| Rule | What it covers | Main requirements for a dental office |
|---|---|---|
| Privacy Rule | How patient information may be used and shared, and patients' rights | Privacy officer, Notice of Privacy Practices, minimum necessary, patient access, training, policies |
| Security Rule | Protecting electronic patient information (ePHI) | Security officer, risk analysis, risk management, security training, technical safeguards |
| Breach Notification Rule | What to do when unsecured patient information is exposed | Notify patients, HHS and sometimes the media, within set deadlines |
Name a privacy officer and a security officer
The Privacy Rule requires you to designate a privacy official, and a contact person or office to receive complaints. The Security Rule requires you to identify a security official. One person can hold both roles. Write the names into your policies.
Notice of Privacy Practices
The notice tells patients how you use their information and what their rights are. A dental office must:
- give the notice to each patient no later than the date of their first visit,
- make a good faith effort to get a written acknowledgment that they received it, and record why if you couldn't,
- post it in a clear and prominent location in the office, with copies patients can take, and
- post it prominently on your website, if you have one.
Keep the signed acknowledgments for 6 years.
Written policies and procedures
Both rules require written policies, kept current. At minimum, cover: who can see what patient information, how patients get copies of records, how you handle requests to send records elsewhere, passwords and device use, email and texting, faxing, disposal of paper and drives, reporting a suspected breach, and sanctions for staff who break the rules.
Security risk analysis
The Security Rule requires "an accurate and thorough assessment of the potential risks and vulnerabilities" to the electronic patient information you hold. Then you must put in place security measures that reduce those risks "to a reasonable and appropriate level."
For a dental office the analysis usually covers the practice management software, imaging and X-ray systems, workstations and laptops, phones and tablets, email, backups, Wi-Fi, and any cloud services. For each one, record the risks you found, what you did about them and when.
HIPAA doesn't set a fixed interval. The Security Rule requires you to review and update your documentation as needed in response to changes. Redoing the risk analysis every year, and after any major system change, keeps it current and gives you a dated record.
Staff training
Two training requirements apply:
- Privacy Rule: train every workforce member on your privacy policies "as necessary and appropriate" for their job. Train new staff within a reasonable period after they start, and retrain affected staff within a reasonable period after a material policy change. Document the training.
- Security Rule: run a security awareness and training program for all workforce members, including leaders. Typical topics are passwords, phishing, malware and logging in and out.
HIPAA does not require training on a fixed yearly date. Training everyone once a year is a simple way to keep up, and you can schedule it with your OSHA training so both are done together.
Business associate agreements
A business associate is a vendor that creates, receives, keeps or sends patient information for you. Before sharing patient information with one, you need a written business associate agreement (BAA) in which the vendor agrees to protect it.
Common dental business associates:
- cloud practice management and imaging software,
- your IT provider or managed services company,
- billing services and clearinghouses,
- online scheduling, reminders and patient messaging,
- shredding and records storage companies, and
- lawyers, accountants and consultants who see patient information.
Keep a list of vendors and the date each BAA was signed.
Patient rights and minimum necessary
- Right of access. When a patient asks for their records, act on the request no later than 30 days after you receive it. You may extend once, by no more than 30 days, if you tell the patient in writing within the first 30 days why and when you will finish.
- Minimum necessary. Make reasonable efforts to use and share only the minimum patient information needed for the purpose. This does not apply to sharing with another provider for treatment, such as a referral to an oral surgeon.
Email, texting, laptops and sign-in sheets
These are everyday areas where a dental office needs a written decision:
- Email and texting. HHS guidance says you may send unencrypted email to a patient who has been warned of the risk and still prefers it. Otherwise use encrypted or secure messaging, and send only what's needed.
- Laptops, phones and backup drives. Encryption is an addressable safeguard in the Security Rule, which means you must use it where it's reasonable and appropriate, or document why not and what you use instead. Encrypted devices also matter after a theft: the breach notification rules apply to unsecured information.
- Sign-in sheets. HHS says you may use sign-in sheets and call out patient names in the waiting room, as long as the information is appropriately limited. Ask for the name and time, not the reason for the visit.
Breach notification
A breach is an unpermitted use or disclosure of unsecured patient information. Unless a documented risk assessment shows a low probability that the information was compromised, you must notify:
| Who | When |
|---|---|
| Each affected patient | Without unreasonable delay, and no later than 60 calendar days after you discover the breach |
| HHS, for fewer than 500 people | Log it, and report it no later than 60 days after the end of the calendar year |
| HHS, for 500 or more people | At the same time you notify the patients |
| Local media, for more than 500 residents of a state or area | Without unreasonable delay, and no later than 60 calendar days after discovery |
How long to keep HIPAA records
Keep policies, risk analyses, training records, signed acknowledgments, BAAs and other required documentation for 6 years from the date each was created or last in effect, whichever is later.
HIPAA checklist for dental offices
- Name your privacy officer, security officer and complaint contact in writing.
- Give every patient the Notice of Privacy Practices, collect acknowledgments, and post it in the office and on your website.
- Write or update your privacy and security policies, including email, texting, devices and disposal.
- Complete the security risk analysis and record what you fixed and when.
- Encrypt laptops, phones and backup drives, or document why not and what you use instead.
- List every vendor that handles patient information and get a signed BAA from each.
- Train all staff on your policies and on security awareness, and record who attended.
- Set up a way to handle patient record requests within 30 days.
- Write down your breach response steps and who decides on notification.
- File everything where you can find it, and keep it for 6 years.
Rule changes to watch
HHS published a proposed update to the Security Rule in January 2025. A proposed rule is not in force. The current Security Rule applies until a final rule is published and takes effect. We update this page when that happens.
OSHA and HIPAA together
HIPAA is enforced by the HHS Office for Civil Rights. OSHA is a separate agency with separate rules for staff safety. For the OSHA side, see the dental OSHA compliance checklist and the exposure control plan template. ComplyDay covers both with OSHA and HIPAA training for dental offices in one plan.