HIPAA Compliance Checklist for Dental Practices

Last updated: 2026-04-06 — ComplianceStack Editorial Team

18 items
Progress 0 of 18 reviewed

Dental practices are covered entities under HIPAA, which means every patient record, digital X-ray, and insurance claim you handle is Protected Health Information. OCR enforcement actions against dental offices have increased since 2022, with most violations traced to missing Business Associate Agreements, unsecured imaging systems, and front-desk disclosure errors. This checklist covers the 18 items that matter most, in priority order.

Priority Legend:
● Critical ● High ● Medium ● Ongoing

HIPAA Compliance Checklist for Dental Practices

1

Designate a HIPAA Privacy Officer and Security Officer

Critical 1 day

One person can fill both roles in a small practice. Document the appointment in writing with a signed acknowledgment and specific responsibilities listed.

45 CFR 164.530(a)(1) (Privacy Officer); 45 CFR 164.308(a)(2) (Security Officer)
2

Conduct a Security Risk Assessment (SRA)

Critical 2-4 days

Required annually. Use the HHS SRA Tool or equivalent to identify threats to ePHI. Document every finding and your remediation plan, even if the risk is accepted.

45 CFR 164.308(a)(1)(ii)(A)
3

Execute BAAs with every vendor who touches PHI

Critical 3-5 days

Dental labs, imaging centers, cloud-based practice management software (Dentrix, Eaglesoft, Open Dental), IT support, shredding companies, and answering services all need signed BAAs before they receive any PHI.

45 CFR 164.502(e); 45 CFR 164.504(e)
4

Encrypt all digital X-rays and intraoral images at rest and in transit

Critical 1-2 days

DICOM files stored on local servers, USB drives, or cloud storage must be encrypted with AES-128 or stronger. Unencrypted portable media is the #1 breach vector for dental offices.

45 CFR 164.312(a)(2)(iv); 45 CFR 164.312(e)(2)(ii)
5

Implement unique user logins for every staff member in your practice management system

Critical 1 day

Shared logins make audit trails useless and violate the HIPAA access control standard. Every hygienist, assistant, and front-desk employee needs their own credentials.

45 CFR 164.312(a)(2)(i) (Unique User Identification)
6

Create and distribute a Notice of Privacy Practices (NPP)

High 2 days

Must be provided to every patient at their first visit and posted in a visible location in the office. Keep signed acknowledgment forms on file. Update whenever your privacy practices change.

45 CFR 164.520
7

Train all staff on HIPAA privacy and security annually

High 1 day per year

Document the training date, topics covered, and attendee signatures. New hires must complete training within 30 days. Cover front-desk scenarios: confirming appointments to callers, discussing treatment in open areas, handling records requests.

45 CFR 164.530(b)(1); 45 CFR 164.308(a)(5)
8

Establish a breach notification procedure

High 2 days

Document how you will investigate a suspected breach, determine if notification is required, and notify affected individuals within 60 days. Breaches affecting 500+ people require HHS and media notification.

45 CFR 164.400-414 (Breach Notification Rule)
9

Secure physical access to server rooms and records storage

High 1 day

Lock the room or closet containing your practice management server. Limit access to authorized personnel. Log entry if possible. Paper charts must be in locked cabinets when not actively in use.

45 CFR 164.310(a)(1) (Facility Access Controls)
10

Configure automatic logoff on all workstations

High Half day

Set screens to lock after 2-5 minutes of inactivity. Operatory workstations in patient areas are high-risk — patients and visitors can see open records if the screen stays active.

45 CFR 164.312(a)(2)(iii)
11

Implement email encryption for any PHI sent electronically

High 1-2 days

Patient appointment reminders, treatment plans, and referral letters containing PHI must be encrypted or sent through a HIPAA-compliant patient portal. Gmail and Outlook are not HIPAA-compliant by default.

45 CFR 164.312(e)(1) (Transmission Security)
12

Maintain a complete inventory of all devices that store or access ePHI

Medium 1 day

Include workstations, laptops, tablets, smartphones, USB drives, backup drives, and cloud services. Track device location, encryption status, and responsible person.

45 CFR 164.310(d)(1) (Device and Media Controls)
13

Establish media disposal and re-use procedures

Medium Ongoing

Hard drives from decommissioned workstations must be wiped (NIST 800-88 guidelines) or physically destroyed. Paper records must be cross-cut shredded. Document every disposal.

45 CFR 164.310(d)(2)(i-ii)
14

Set up audit logging on your practice management system

Medium Half day + quarterly reviews

Enable and review access logs to track who viewed, modified, or exported patient records. Review logs at least quarterly. Anomalies — like a staff member accessing records of patients they did not treat — should trigger investigation.

45 CFR 164.312(b) (Audit Controls)
15

Create a data backup and disaster recovery plan

Medium 2-3 days

Back up ePHI daily. Store backups encrypted and offsite (or in a HIPAA-compliant cloud with a BAA). Test restoration at least annually. Document your Recovery Time Objective.

45 CFR 164.308(a)(7)(ii)(A-D) (Contingency Plan)
16

Post sign-in sheets that collect minimum necessary information

Medium Half day

If you use a paper sign-in sheet, patients should not be able to see the reason for other patients' visits. Use a sign-in sheet that covers previous entries or switch to electronic check-in.

45 CFR 164.502(b) (Minimum Necessary Standard)
17

Develop a patient rights procedure for access, amendment, and accounting of disclosures

Medium 2 days

Patients have the right to obtain copies of their records within 30 days of request, request amendments, and receive an accounting of disclosures. Have a documented workflow for each request type.

45 CFR 164.524, 164.526, 164.528
18

Review and update all policies and procedures at least annually

Ongoing 1-2 days per year

HIPAA requires policies to be maintained for six years. Assign a review date, document changes, and re-train staff on any updates. Keep prior versions for the retention period.

45 CFR 164.530(j) (Documentation Requirements)

See How Your Dental Practice Scores on HIPAA

Run a free gap analysis to find out which items you have covered and where the risks are.

Gap Analyzer →   Training Tracker →

Common Mistakes That Trigger Enforcement

Sending unencrypted X-ray images to specialists via personal email
Unencrypted ePHI in transit is a reportable breach if intercepted. OCR has fined dental practices $50K+ for this.
No BAA with your practice management software vendor
Without a BAA, every record in that system is an ongoing HIPAA violation — regardless of whether a breach has occurred.
Discussing patient treatment at the front desk where other patients can overhear
Incidental disclosures are permitted only if you have reasonable safeguards in place. An open layout with no attempt at privacy is a violation.
Using a shared login across multiple workstations
Eliminates your audit trail entirely. If a breach occurs, you cannot determine who accessed the compromised records.
Failing to conduct an annual Security Risk Assessment
The SRA is the single most-cited deficiency in OCR enforcement actions. There is no shortcut or exemption for small practices.

Frequently Asked Questions

Are dental practices required to comply with HIPAA?

Yes. Any dental practice that transmits health information electronically — including insurance claims, electronic prescriptions, or digital referrals — is a covered entity under HIPAA. This applies to solo practitioners, group practices, and dental service organizations (DSOs) of any size.

Do I need a BAA with my dental lab?

Yes. If you send patient information to a dental lab — including patient name, case details, or digital impressions — that lab is a Business Associate. You must have a signed BAA in place before sharing any PHI. This applies to both local and remote labs.

How often must dental staff complete HIPAA training?

HIPAA requires training when new staff join and whenever policies materially change. Best practice — and the standard OCR expects during audits — is annual refresher training for all staff members, with documentation of attendance and topics covered.

✉ Save This Checklist

Enter your email and we'll send you a clean copy — plus updates when requirements change.

We also offer a free personalized gap analysis for your specific situation.

Related Resources