This post is a plain checklist built from pages at HHS.gov. It is general education for dentists, practice owners and office managers. It is not legal advice, and it does not tell any office what it must do. A HIPAA adviser or attorney can confirm how the rules apply to a specific office.
What is HIPAA, and who must follow it?
HIPAA is a federal law, and HHS has written three main rules under it that matter to a dental office: the Privacy Rule, the Security Rule and the Breach Notification Rule. HHS says the Privacy Rule applies to three types of covered entities: “health plans, health care clearinghouses, and health care providers who conduct the standard health care transactions electronically.”
An office that conducts those standard transactions electronically is a covered provider under that description. Whether yours is covered is a question for an adviser. The HHS page lists the rules and dates, including the Enforcement Rule and the Omnibus rule that finalized breach notification.
| Rule | What it covers (HHS summary) |
|---|---|
| HIPAA Privacy Rule | National standards for protecting individually identifiable health information |
| Security Rule | Protecting the confidentiality, integrity and availability of electronic protected health information |
| Breach Notification Rule | Notice to individuals, HHS and, in some cases, the media |
| Enforcement Rule | Standards for enforcing the other rules |
What does the Security Rule ask for?
The Security Rule asks for three kinds of safeguards: administrative, physical and technical. HHS states that it “requires implementation of appropriate administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of electronic protected health information.”
In plain terms, think of three questions about your records:
- Administrative. Who is in charge of privacy and security, and what do staff learn and sign?
- Physical. Who can reach the server closet, the front desk screen and the paper charts?
- Technical. How do you control logins, back up data and protect the network?
HHS also points to a tool for risk assessment. The HHS Security Rule page says the tool is “useful in assisting small and medium-sized health care practices and business associates as they perform a risk assessment.” A risk assessment is a written look at where patient data lives and what could go wrong. An adviser can tell you what documentation your office needs.
What is a plain HIPAA checklist for the office?
A checklist helps a team see gaps. The items below are prompts for a conversation with an adviser. They are not a legal standard, and passing them does not prove compliance.
| Area | Question to ask |
|---|---|
| People | Does one person own privacy and security tasks? |
| Training | Do new hires and current staff get privacy training, and is it written down? |
| Inventory | Do we know every system that holds patient data, including practice management software? |
| Risk | Have we done a written risk assessment, and when did we last update it? |
| Access | Does each person have their own login with only the access the job needs? |
| Backups | Do we have backups, and do we test a restore? |
| Vendors | Do we have a written contract with each vendor that handles patient data? |
| Incidents | Does the team know who to tell if something goes wrong? |
What about vendors that touch patient data?
A vendor that handles patient data for your office is often a business associate, and HHS expects a written contract. HHS states that “a business associate may use or disclose protected health information only as permitted or required by its business associate contract or as required by law.”
A business associate agreement is that contract. Offices usually need one for software hosts, billing services and similar vendors. Ask your adviser which of your vendors need one, and keep copies where the office manager can find them.
What happens after a breach?
HHS says that after a breach of unsecured protected health information, covered entities “must provide notification of the breach to affected individuals, the Secretary, and, in certain circumstances, to the media.” The timing depends on size.
| Situation | HHS timing (Breach Notification Rule) |
|---|---|
| Notice to affected individuals | Without unreasonable delay, no later than 60 days after discovery |
| Breach of 500 or more people | Notify HHS without unreasonable delay, no later than 60 days |
| Breach of fewer than 500 people | HHS notice may be given annually, within 60 days after year end |
| More than 500 residents of one state | Notice to prominent media outlets, same 60-day limit |
An office that has a plan before a breach can move faster. The related post on ransomware and data breaches covers response steps. Always confirm deadlines with an attorney, because state laws can add duties.
Who in the office should own HIPAA tasks?
One named person keeps tasks from falling through. In many offices, that is the office manager or practice manager, working with the owner dentist and an outside adviser. A short written job description for the role helps, and so does a yearly calendar date for review. HHS also runs email lists for OCR privacy and security guidance, and the HHS HIPAA page invites readers to sign up.
Where does this fit in a wider compliance plan?
HIPAA is one of several areas that a dental office tracks. OSHA covers workplace safety and CDC covers infection control. The dental compliance checklist puts the areas side by side. The posts on OSHA requirements and CDC infection control cover the other two. The glossary also explains risk management.
Next step
For the full picture, read the dental compliance checklist. To ask about consulting, contact Dr. Copeland about consulting.
Frequently asked questions
What is HIPAA compliance for a dental office?
It means following the HIPAA Privacy, Security and Breach Notification Rules for patient health information. The rules apply to health care providers who conduct certain electronic transactions, which includes many dental offices. A qualified adviser can confirm how they apply to a specific office.
Does HIPAA require a security risk assessment?
The HHS Security Rule page points small and medium-sized practices to a risk assessment tool, and the Security Rule asks for safeguards to protect electronic patient information. Ask a HIPAA adviser what documentation your office needs.
When must a dental office report a breach?
HHS says affected individuals must be told without unreasonable delay and within 60 days of discovery. Breaches of 500 or more people also go to HHS within 60 days. Smaller breaches may be reported to HHS yearly. Confirm timing with an adviser.
Terms on this page
Sources
- HHS: HIPAA for Professionals
- HHS: The Security Rule
- HHS: Breach Notification Rule
- HHS: Business Associate Contracts
Written by Copeland Consulting Services and checked against the sources above on October 26, 2026. Rules, data and guidance change, so check the linked page before you act on it.