HIPAA Compliance Checklist for Dental Practices
Last updated: 2026-05-22 — ComplianceStack Editorial Team
Dental practices are covered entities under HIPAA, which means every patient record, digital X-ray, and insurance claim you handle is Protected Health Information. OCR enforcement actions against dental offices have increased since 2022, with most violations traced to missing Business Associate Agreements, unsecured imaging systems, and front-desk disclosure errors. This checklist covers the 18 items that matter most, in priority order.
Generate Your Personalized Checklist
Tell us about your dental practices and we'll filter this checklist to what applies to you — with a readiness score and priority gaps highlighted.
📄 Reference Checklist
Generic — use the generator above for a personalized versionHIPAA Compliance Checklist for Dental Practices
Designate a HIPAA Privacy Officer and Security Officer
One person can fill both roles in a small practice. Document the appointment in writing with a signed acknowledgment and specific responsibilities listed.
Conduct a Security Risk Assessment (SRA)
Required annually. Use the HHS SRA Tool or equivalent to identify threats to ePHI. Document every finding and your remediation plan, even if the risk is accepted.
Execute BAAs with every vendor who touches PHI
Dental labs, imaging centers, cloud-based practice management software (Dentrix, Eaglesoft, Open Dental), IT support, shredding companies, and answering services all need signed BAAs before they receive any PHI.
Encrypt all digital X-rays and intraoral images at rest and in transit
DICOM files stored on local servers, USB drives, or cloud storage must be encrypted with AES-128 or stronger. Unencrypted portable media is the #1 breach vector for dental offices.
Implement unique user logins for every staff member in your practice management system
Shared logins make audit trails useless and violate the HIPAA access control standard. Every hygienist, assistant, and front-desk employee needs their own credentials.
Create and distribute a Notice of Privacy Practices (NPP)
Must be provided to every patient at their first visit and posted in a visible location in the office. Keep signed acknowledgment forms on file. Update whenever your privacy practices change.
Train all staff on HIPAA privacy and security annually
Document the training date, topics covered, and attendee signatures. New hires must complete training within 30 days. Cover front-desk scenarios: confirming appointments to callers, discussing treatment in open areas, handling records requests.
Establish a breach notification procedure
Document how you will investigate a suspected breach, determine if notification is required, and notify affected individuals within 60 days. Breaches affecting 500+ people require HHS and media notification.
Secure physical access to server rooms and records storage
Lock the room or closet containing your practice management server. Limit access to authorized personnel. Log entry if possible. Paper charts must be in locked cabinets when not actively in use.
Configure automatic logoff on all workstations
Set screens to lock after 2-5 minutes of inactivity. Operatory workstations in patient areas are high-risk — patients and visitors can see open records if the screen stays active.
Implement email encryption for any PHI sent electronically
Patient appointment reminders, treatment plans, and referral letters containing PHI must be encrypted or sent through a HIPAA-compliant patient portal. Gmail and Outlook are not HIPAA-compliant by default.
Maintain a complete inventory of all devices that store or access ePHI
Include workstations, laptops, tablets, smartphones, USB drives, backup drives, and cloud services. Track device location, encryption status, and responsible person.
Establish media disposal and re-use procedures
Hard drives from decommissioned workstations must be wiped (NIST 800-88 guidelines) or physically destroyed. Paper records must be cross-cut shredded. Document every disposal.
Set up audit logging on your practice management system
Enable and review access logs to track who viewed, modified, or exported patient records. Review logs at least quarterly. Anomalies — like a staff member accessing records of patients they did not treat — should trigger investigation.
Create a data backup and disaster recovery plan
Back up ePHI daily. Store backups encrypted and offsite (or in a HIPAA-compliant cloud with a BAA). Test restoration at least annually. Document your Recovery Time Objective.
Post sign-in sheets that collect minimum necessary information
If you use a paper sign-in sheet, patients should not be able to see the reason for other patients' visits. Use a sign-in sheet that covers previous entries or switch to electronic check-in.
Develop a patient rights procedure for access, amendment, and accounting of disclosures
Patients have the right to obtain copies of their records within 30 days of request, request amendments, and receive an accounting of disclosures. Have a documented workflow for each request type.
Review and update all policies and procedures at least annually
HIPAA requires policies to be maintained for six years. Assign a review date, document changes, and re-train staff on any updates. Keep prior versions for the retention period.
See How Your Dental Practice Scores on HIPAA
Run a free gap analysis to find out which items you have covered and where the risks are.
Gap Analyzer → Training Tracker →Common Mistakes That Trigger Enforcement
Frequently Asked Questions
Are dental practices required to comply with HIPAA?
Yes. Any dental practice that transmits health information electronically — including insurance claims, electronic prescriptions, or digital referrals — is a covered entity under HIPAA (45 CFR §160.103) regardless of practice size or patient volume. Electronic submission of insurance claims alone triggers covered entity status. PHI includes patient names, dental records, x-rays, treatment notes, and billing information.
Do I need a BAA with my dental lab?
Yes. Dental labs that receive patient impressions, x-rays, or treatment information are Business Associates under 45 CFR §164.502(e), and a signed BAA must be in place before sharing any PHI. This applies to digital impressions, CBCT files, shade photos, and any identifying patient information. Without a BAA, sharing PHI with the lab is an unauthorized disclosure subject to HIPAA CMPs of $141–$2,134,831 per violation.
How often must dental staff complete HIPAA training?
HIPAA requires training for all members of the workforce upon hire and whenever policies and procedures materially change (45 CFR §164.530(b)). OCR's audit protocol treats annual refresher training as best practice and the minimum defensible standard. Training must cover the Privacy Rule, Security Rule, and practice-specific policies. Documentation of training completion — dates, attendees, content covered — is required and must be retained for 6 years.
✉ Save This Checklist
Enter your email and we'll send you a clean copy — plus updates when requirements change.
We also offer a free personalized gap analysis for your specific situation.
Related Resources
- Complete HIPAA Framework Guide
- HIPAA for Dental Practices
- HIPAA for Mental Health Providers
- HIPAA Penalty Tiers 2026: $141 to $2.1M Fine Guide
- HIPAA Breach Notification Penalties 2026: 4-Tier Fine Guide
- HIPAA Compliance Checklist for Mental Health Providers
- HIPAA Compliance Checklist for Pharmacies
- HIPAA Compliance Checklist for Telehealth Providers
- Free Compliance Gap Analyzer
- Employee Training Tracker
- 5-Minute Compliance Quiz