Industries · Dental practices

HIPAA compliance consulting for dental practices.

Q: Are dentists under HIPAA?

Yes. Dentists are under HIPAA whenever their practice transmits health information electronically as part of a covered transaction such as filing insurance claims, checking patient eligibility, or sending electronic referrals. There is no size exemption. Solo dentists, group practices, and dental service organizations all must comply with the Privacy Rule, Security Rule, and Breach Notification Rule.

Q: How often must dental staff complete HIPAA training?

HIPAA requires training at hire and when policies change per §164.308(a)(5)(i). Yearly refresher HIPAA training is best practice to stay audit-ready and show ongoing staff awareness. Training records (the date, topics covered, and each person's name) must be kept for at least six years per §164.530(j). OCR often asks for these records first.

Q: Does HIPAA apply to paper records in dental offices?

Yes. Physical safeguard rules under the Security Rule (§164.310) apply to paper charts, printed treatment plans, and any physical media with PHI. Practices must set workstation use policies (§164.310(b)), device and media controls (§164.310(d)), and disposal steps like cross-cut shredding. A gap analysis of physical safeguards often finds issues with printer placement, shared desks, and paper storage that are easy to fix once spotted.

Dental practices are covered entities under HIPAA when they send health data in digital form as part of a covered transaction, such as filing claims with a health plan (45 CFR 160.103). That includes solo offices, group practices, dental service organizations (DSOs), and specialties like orthodontics, periodontics, and oral surgery. For a full overview of what dental offices need to address, see our guide to HIPAA compliance for dental practices.

Book your free 30-minute intro call See plans and pricing

3core HIPAA rules every dental covered entity follows

5required compliance steps, each tied to a CFR rule

60 daysto notify patients after a breach is discovered

6 yrsto keep policies, training records, SRAs, and BAAs

Diagram: the five required HIPAA steps for dental practices, in order: Security Risk Assessment, policies and procedures, workforce training, Business Associate Agreements, documentation retention.

Are dentists under HIPAA?

Yes.Whenever the practice transmits health information electronically.

There is no size exemption. A solo dentist who files claims online faces the same rules as a large DSO.

Any of these makes you a covered entity

+Filing insurance claims +Checking patient eligibility +Sending electronic referrals +Any digital system that stores patient records

Who we work with

Solo officesGroup practicesMulti-location DSOsOrthodonticsPeriodonticsOral surgery

Where dental offices get exposed

The risks that are specific to dentistry.

PHI in a dental office includes intake forms, treatment plans, clinical notes, imaging files, insurance claims, appointment records, and billing data. Any data that names a patient and relates to their dental care, payment, or health plan counts as PHI under 45 CFR 160.103. These are the places it most often slips.

Imaging

Digital X-rays, CBCT, and intraoral images

Imaging data is ePHI. It needs access controls, audit logs, and secure sending, and the imaging vendor must sign a BAA before any PHI is stored in or sent through their system.

164.312(a), (b), (e)164.308(b)(1)

Workstations

Shared imaging workstations

Imaging workstations must enforce unique user authentication, and imaging vendors must not store or transmit patient data outside the scope of their signed BAA.

164.312(d)

Messaging

Texted and emailed reminders

Reminders are allowed for treatment, but contact choices belong in your NPP and requests for limits must be honored. A reminder that names the procedure carries more PHI risk than one with just the date and time.

164.522(a)164.520

Front desk

Paper charts, printers, and shared screens

Physical safeguards cover paper charts and printed treatment plans. Gap reviews commonly surface printer placement, shared workstation access, and paper storage issues that are simple to fix once found.

164.310(b), (d)

Vendors

IT, cloud, billing, and imaging vendors with no BAA

Many dental offices have no BAAs with IT or imaging vendors. The BAA should cover the data types the vendor handles, including old image files and any cloud backup the vendor runs.

164.308(b)(1)164.502(e)

DSOs

Multi-location groups

DSOs face added work setting up uniform policies across offices with different EHR systems, staffing, and state rules. An organization-level gap analysis is the right starting point before aligning policies across sites.

164.316(a)

What applies to you

Three rules. Here is what each one means in a dental office.

Privacy Rule

How PHI is used and shared

45 CFR Part 164, Subpart E

Give patients a Notice of Privacy Practices (NPP)
Honor patient rights to view and fix records
Share only the least PHI needed for the task

Security Rule

Safeguards for electronic PHI

45 CFR Part 164, Subpart C

Administrative, physical, and technical safeguards
Practice management software and email
X-rays, CBCT, intraoral cameras, and cloud backups

Breach Notification Rule

What to do when PHI leaks

45 CFR Part 164, Subpart D

A breach of unsecured PHI is the acquisition, access, use, or disclosure of PHI in a way the Privacy Rule does not permit that compromises its security or privacy (164.402)
Notify affected patients within 60 days of discovery (164.404)
500 or more affected: also report to HHS (164.408) and prominent media (164.406)
A documented incident management process covering breach detection, risk assessment, and notice timelines keeps you inside the 60-day window

without unreasonable delay and in no case later than 60 calendar days after discovery of a breach.45 CFR 164.404(b)

Implement procedures to verify that a person or entity seeking access to electronic protected health information is the one claimed.45 CFR 164.312(d)

How One Guy Consulting helps

Five required steps, done in the right order.

These steps apply to every dental covered entity. Each ties to a specific CFR rule and carries its own fine risk if left undone. See our HIPAA compliance cost breakdown for what practices typically spend.

01
Security Risk Assessment
Find threats and weak points in all ePHI the practice creates, receives, stores, or sends. A documented risk assessment is the most common missing item when OCR looks into dental practices.

164.308(a)(1)(ii)(A)
Start hereAlmost everything else builds on it.
02
Written policies and procedures
Cover privacy, security, breach notice, and staff conduct. Dental-specific policy templates skip vague language and match real workflows like imaging room access, patient check-in, and insurance billing.

164.316(a)
Dental fitImaging rooms, check-in, and insurance billing.
03
Workforce training
All staff with PHI access (front desk, hygienists, assistants, and billing staff) get HIPAA training at hire and when policies change. Yearly refreshers are best practice.

164.308(a)(5)(i)
Keep the proofDate, topics, and each person's name, for six years.
04
Business Associate Agreements
Required before any vendor handles PHI. Signed with IT providers, cloud storage vendors, billing services, imaging software companies, and any other entity that handles PHI for the practice. We track them with BAA management.

164.308(b)(1)164.502(e)
Check the scopeOld image files and vendor-run cloud backups included.
05
Documentation retention
Policies, training records, risk assessments, and BAAs are kept for six years, organized so you can hand them over when OCR asks.

164.530(j)
First requestOCR often asks for training records first.

Not sure where you stand? A gap analysis ties each gap to the CFR rule it breaks and ranks fixes by fine risk.

Common gaps

Where dental practices usually fall short.

A structured gap analysis ties each gap to the CFR rule it breaks and ranks fixes by fine risk. For multi-location DSOs, a gap analysis at the organization level is the right starting point before aligning policies across sites.

What we find most often

!No documented Security Risk Assessment !Old policies that do not match current workflows !No BAAs with IT or imaging vendors !No staff training records !DSOs: different EHR systems, staffing, and state rules across offices

Enforcement

OCR looks into dental practices too.

The Office for Civil Rights (OCR) enforces HIPAA for all covered entities, including dental practices. Fines range from $145 to $2,190,294 per violation type per year under 45 CFR 160.404.

OCR has looked into dental practices for:

Complaints about unauthorized sharing
Missing risk assessments
Failure to give patients their records within 30 days, per 164.524(b)(2)

There is no size exemption. A solo office and a large DSO face the same requirements.

Key definitions for dental practices

PHI: Individually identifiable health information about a patient's condition, treatment, or payment. 45 CFR 160.103
ePHI: PHI created, received, maintained, or transmitted in electronic form: practice management software, digital imaging, email, and cloud backups.
Covered Entity: A health plan, healthcare clearinghouse, or healthcare provider that transmits health information electronically in connection with a covered transaction. 45 CFR 160.103
Business Associate: A person or entity that performs functions or activities involving PHI on behalf of a covered entity. 45 CFR 160.103
Business Associate Agreement: The written contract, required under 45 CFR 164.502(e), that sets permitted uses and disclosures of PHI with a vendor. 164.502(e)
Notice of Privacy Practices: The document patients receive describing how their PHI may be used and disclosed. 164.520

Pricing

One flat price for the whole dental office.

Two plans, six ways to pay. No per-user fees, so adding a hygienist or a front-desk hire does not change your bill. Every step above is covered in both plans.

For advanced users

Self-Guided

$675 / 12 months

or $60 / month

The platform on its own
SRA, gap analysis, remediation plans
Policy templates and staff training
Vendor and BAA management

Compare plans

Dental HIPAA, answered.

Are dental practices required to comply with HIPAA?+

Yes. Any dental practice that sends health data digitally as part of a covered transaction (such as e-claims, eligibility checks, or referral requests) is a covered entity under 45 CFR 160.103. It must follow the Privacy, Security, and Breach Notification Rules. These duties apply no matter the practice size: a solo dentist who files claims online faces the same rules as a large DSO. The first step is a formal security risk assessment that records the current state of ePHI safety across all systems.

Do dental imaging systems have specific HIPAA requirements?+

Yes. Digital X-rays, CBCT scans, and intraoral images are ePHI. They must be stored with access controls (164.312(a)), tracked with audit logs (164.312(b)), and sent securely with encryption (164.312(e)). The imaging vendor must sign a BAA per 164.308(b)(1) before any PHI is stored in or sent through their system. Make sure the BAA covers the data types the vendor handles, including old image files and any cloud backup the vendor runs.

How often must dental staff complete HIPAA training?+

HIPAA requires training at hire and when policies change (164.308(a)(5)(i)). Yearly refresher HIPAA training is best practice to stay audit-ready and show ongoing staff awareness. Training records (the date, topics covered, and each person's name) must be kept for at least six years per 164.530(j). OCR often asks for these records first.

Does HIPAA apply to paper records in dental offices?+

Yes. Physical safeguard requirements under the Security Rule (164.310) apply to paper charts, printed treatment plans, and any physical media containing PHI. Practices must implement workstation use policies (164.310(b)), device and media controls (164.310(d)), and documented disposal procedures such as cross-cut shredding. A gap analysis of physical safeguards commonly surfaces deficiencies in printer placement, shared workstation access, and paper record storage that are straightforward to correct once identified.

Can dental practices text appointment reminders to patients?+

HIPAA allows treatment-related messages through the patient's preferred channel. The practice must list its contact methods in its NPP and honor patient requests for limits per 164.522(a). If the reminder includes clinical detail, such as the type of procedure, it carries more PHI risk than a message with just the date and time. Practices should keep communication policies that say what can go in plain text messages and what needs a safer channel. If a messaging error leads to a PHI leak, the practice must check whether a breach notice is required under 164.400.

For dental offices and DSOs

Find the gaps in your practice before OCR does.

One Guy Consulting is based in Queens, New York, and works with dental offices nationwide: solo offices, group practices, and multi-location DSOs.

Book your free 30-minute intro call HIPAA compliance near you

Keep going

One Guy Consulting

HIPAA services for dental practices

SRASecurity Risk AssessmentFind the risks to your patient data, on paper, the way the rule asks. GAPGap AnalysisSee exactly where your program falls short, ranked by risk. POLPolicy TemplatesWritten policies you can customize for your office. TRNHIPAA Staff TrainingTraining with completion tracked for every employee. BAABAA ManagementDigital Business Associate Agreements, signed and stored. VNDVendor ManagementA living list of every vendor that touches PHI. IRIncident ManagementA breach workflow ready before you need it. 1:1HIPAA ConsultingWork directly with Chuck, not a ticket queue.