Sign inStart your plan

HIPAA forms for dental offices (free printable templates)

Last reviewed November 7, 2026  ·  7 sources

Short answer

The HIPAA forms a dental office needs start with a Notice of Privacy Practices and a signed acknowledgment that each patient received it. You also need an authorization form for any disclosure that requires the patient's permission, with every element listed in 45 CFR 164.508.

Below are six free printable HIPAA forms for dental offices, built from the HIPAA rules: the acknowledgment, an authorization, a records request, a confidential communications request, a restriction request and a family contact list.

Which HIPAA forms a dental office needs

FormRequired?RuleKeep
Notice of Privacy PracticesYes, give it at the first visit and post it45 CFR 164.5206 years
Notice acknowledgmentA good faith effort to get one is required45 CFR 164.520(c)(2)(ii)6 years
Authorization to use or discloseYes, for disclosures outside treatment, payment and operations45 CFR 164.5086 years
Records requestOptional; you may require written requests if you tell patients in advance45 CFR 164.524(b)(1)Your records policy
Confidential communications requestOptional; you may require these in writing45 CFR 164.522(b)(2)Your records policy
Restriction requestAgreed restrictions must be documented45 CFR 164.522(a)(3)6 years
Family and friends contact listNot required45 CFR 164.510(b)While in effect

Your Notice of Privacy Practices is specific to your office, so it isn't in this pack. It must describe how you use and share patient information, the patient's rights and your duties, and it must include the required header statement. Your privacy policies should match it.

1. Notice of Privacy Practices acknowledgment

Give every patient your notice no later than their first visit, and ask them to sign that they received it. If they don't sign, write down what you did and why it wasn't signed. In an emergency, give the notice as soon as reasonably practicable afterward.

Acknowledgment of receipt of Notice of Privacy Practices

complyday.com
Office name:

I received a copy of this office's Notice of Privacy Practices. It explains how the office may use and share my health information and my rights about that information.

Patient name:Date of birth:Phone:

For the office: if the acknowledgment was not signed

Required by 45 CFR 164.520(c)(2)(ii) when no signature is obtained, except in an emergency treatment situation.

  • Patient was given the notice but declined to sign
  • Patient could not sign. Reason:
  • Emergency treatment situation. Notice to be given as soon as reasonably practicable after the emergency
  • Other good faith effort and reason:

Give the notice no later than the first visit, post it in a clear and prominent place in the office, and post it on your website if you have one (45 CFR 164.520(c)). Keep signed acknowledgments, or the record of your good faith effort, for 6 years (45 CFR 164.530(j)).

2. HIPAA authorization form for dental offices

Use this when a patient asks you to send their information somewhere that isn't for treatment, payment or your operations, for example to a lawyer or an employer. A valid authorization must contain:

  • a specific description of the information,
  • who may disclose it and who may receive it,
  • the purpose ("at the request of the individual" is enough when the patient starts the request),
  • an expiration date or event,
  • the patient's signature and date, and a description of a personal representative's authority if one signs,
  • statements about the right to revoke in writing, that treatment won't be conditioned on signing, and that the recipient may redisclose the information.

It must be in plain language, and the patient gets a copy.

Authorization to use or disclose health information

complyday.com
Patient name:Date of birth:Phone:

1. Information to be used or disclosed

  • Complete dental record
  • X-rays and images
  • Treatment notes from (date) ________ to (date) ________
  • Billing and payment records
  • Other (describe):

2. Who may disclose it

Office name:Address:

3. Who may receive it

Name or organization:Address:Phone, fax or email:

4. Purpose

  • At my request
  • Other (describe):

5. This authorization ends

On this date:Or when this event happens:

Your rights

  • You may revoke this authorization at any time by giving the office written notice at the address above. Revoking it does not undo any use or disclosure the office already made in reliance on it.
  • The office will not condition your treatment, payment, enrollment or eligibility for benefits on whether you sign this authorization.
  • Information disclosed under this authorization may be redisclosed by the person who receives it and may no longer be protected by federal privacy rules.
  • You will receive a copy of this signed form.

Core elements and required statements: 45 CFR 164.508(c). Not needed for treatment, payment or health care operations, such as sending records to a specialist for treatment. Keep for 6 years (45 CFR 164.508(b)(6), 164.530(j)).

3. Request for access to dental records

Patients have the right to see and get a copy of their records, including x-rays. Act on the request no later than 30 days after you receive it. You may extend once, by up to 30 more days, if you tell the patient in writing within the first 30 days why and when you'll finish.

Request to inspect or get a copy of dental records

complyday.com
Patient name:Date of birth:Phone:
Mailing address:Email:

Records requested

  • Complete dental record
  • X-rays and images
  • Records from (date) ________ to (date) ________
  • Billing records
  • Other:

How I want to receive them

  • Inspect them at the office
  • Paper copy, picked up
  • Paper copy, mailed to the address above
  • Electronic copy (format, if any): ________
  • Email to the address above. I understand regular email may not be secure

Send a copy directly to another person (optional)

Name:Address or email:

For the office

Rules: 45 CFR 164.524. You may require written requests if you tell patients in advance. A request to send records to another person must be in writing, signed, and name the person and where to send them. Any fee must be reasonable and cost-based, covering only labor for copying, supplies, postage and, if the patient agrees, preparing a summary.

4. Confidential communications request

A patient can ask you to call a different number, skip voicemail or send mail to another address. A dental office must accommodate reasonable requests and can't ask the patient why.

Request for confidential communications

complyday.com
Patient name:Date of birth:Phone:

I ask the office to contact me about appointments, treatment and bills only in the ways I mark below. I do not have to give a reason.

Phone

  • Call me only at this number: ________________
  • You may leave a detailed message
  • Leave only your name and number
  • Do not leave a message
  • Texts are OK at this number

Mail and email

  • Send mail only to this address: ________________
  • Email only to this address: ________________
  • Do not email me

Bills

Send bills to (if different):

For the office

Rules: 45 CFR 164.522(b). A dental office must accommodate reasonable requests and may ask for them in writing, but may not require the patient to explain why. It may ask for an alternative address or contact method and how payment will be handled.

5. Request to restrict a disclosure

You don't have to agree to most restriction requests. You must agree when a patient pays for a service in full and asks you not to send information about it to their health plan, unless the law requires the disclosure. Once you agree to a restriction, you have to follow it.

Request to restrict use or disclosure of health information

complyday.com
Patient name:Date of birth:Phone:

What I want restricted

Information:Not to be shared with:
  • Do not send information about the service(s) below to my health plan. I have paid, or will pay, for them in full myself.
Service(s) and date(s):

For the office

  • Agreed
  • Not agreed. Patient told on (date):
  • Paid in full, health plan restriction. Must be agreed unless the disclosure is required by law

Rules: 45 CFR 164.522(a). An office does not have to agree to most restriction requests, but once it agrees it must follow the restriction except in an emergency. It must agree not to send a health plan information about a service the patient, or someone other than the plan, paid for in full, when the disclosure is for payment or operations and not required by law. Document agreed restrictions and keep them for 6 years.

6. Family and friends contact list

HIPAA lets you share information with a family member or friend involved in a patient's care or bills if the patient agrees or doesn't object when given the chance. No form is required. A written list helps every staff member check quickly before they talk to someone on the phone.

People the office may talk to about my care

complyday.com
Patient name:Date of birth:Phone:

The office may share information directly related to my dental care or bills with the people listed below.

NameRelationshipPhoneWhat may be shared (appointments, treatment, bills)

Optional. HIPAA does not require a written form for this. Under 45 CFR 164.510(b), you may share information relevant to a person's involvement in the patient's care or payment if the patient agrees or does not object when given the chance. A written list makes the patient's choice easy for every staff member to check.

Open the printable version or use the download button to get all six forms as one PDF.

How to use these forms

  1. Add your office name and address to each form.
  2. Make sure the forms match your Notice of Privacy Practices and your written privacy policies.
  3. Train the front desk on when to hand out each one. The topics are in HIPAA training for dental offices.
  4. File signed forms in the patient's record, and keep them for 6 years. Check whether your state requires longer for dental records.

Questions

What HIPAA forms does a dental office need?

At minimum: a Notice of Privacy Practices, a way to record that each patient received it, and an authorization form for disclosures that need the patient’s permission. Most offices also use forms for records requests, confidential communications and restriction requests, because patients have a right to make those requests and written forms make them easy to track.

Do patients have to sign the Notice of Privacy Practices acknowledgment?

No. The office must make a good faith effort to get a written acknowledgment, except in an emergency. If the patient won’t or can’t sign, document your effort and the reason. You still treat the patient.

Do I need a signed authorization to send records to another dentist?

Not when the records are for the patient’s treatment, such as a referral to an oral surgeon. HIPAA allows disclosures for treatment, payment and health care operations without an authorization. You need one for disclosures outside those purposes, such as most marketing uses.

How long do we keep signed HIPAA forms?

Keep signed authorizations, notice acknowledgments, agreed restrictions and other required HIPAA documentation for 6 years from the date created or last in effect, whichever is later. Your state may require dental records to be kept longer.

Can we charge patients for copies of their records?

Only a reasonable, cost-based fee that covers labor for copying, supplies, postage when mailed, and preparing a summary if the patient agreed to one. Your state may set lower limits.

Sources

  1. eCFR: 45 CFR 164.520, Notice of privacy practices
  2. eCFR: 45 CFR 164.508, Uses and disclosures for which an authorization is required
  3. eCFR: 45 CFR 164.524, Access of individuals to protected health information
  4. eCFR: 45 CFR 164.522, Rights to request privacy protection
  5. eCFR: 45 CFR 164.510, Uses and disclosures requiring an opportunity to agree or object
  6. eCFR: 45 CFR 164.506, Uses and disclosures to carry out treatment, payment, or health care operations
  7. eCFR: 45 CFR 164.530, Administrative requirements (documentation and retention)