--- title: "HIPAA for dental offices: a plain checklist for owners" description: "A plain HIPAA checklist for dental offices, built from HHS pages on the Privacy, Security and Breach Notification Rules. General education, not legal advice." url: https://joncopeland.multisites.ai/blog/hipaa-for-dental-offices publisher: Copeland Consulting Services email: drcopeland@joncopelanddds.com contact: https://joncopeland.multisites.ai/contact --- # HIPAA for dental offices: a plain checklist for owners HIPAA has three rules most dental offices must know: the Privacy Rule, the Security Rule and the Breach Notification Rule. The Security Rule asks for administrative, physical and technical safeguards for electronic patient information. After a breach, notice goes to patients and HHS, and sometimes the media. Ask a qualified adviser about your office. Practice managementPublished October 26, 20264 min read This post is a plain checklist built from pages at HHS.gov. It is general education for dentists, practice owners and office managers. It is not legal advice, and it does not tell any office what it must do. A HIPAA adviser or attorney can confirm how the rules apply to a specific office. ## What is HIPAA, and who must follow it? HIPAA is a federal law, and HHS has written three main rules under it that matter to a dental office: the Privacy Rule, the Security Rule and the Breach Notification Rule. HHS says the Privacy Rule applies to three types of covered entities: “health plans, health care clearinghouses, and health care providers who conduct the standard health care transactions electronically.” An office that conducts those standard transactions electronically is a covered provider under that description. Whether yours is covered is a question for an adviser. The HHS page lists the rules and dates, including the Enforcement Rule and the Omnibus rule that finalized breach notification. Rule What it covers (HHS summary) [HIPAA](https://joncopeland.multisites.ai/glossary/hipaa) Privacy Rule National standards for protecting individually identifiable health information [Security Rule](https://joncopeland.multisites.ai/glossary/hipaa-security-rule) Protecting the confidentiality, integrity and availability of electronic protected health information Breach Notification Rule Notice to individuals, HHS and, in some cases, the media Enforcement Rule Standards for enforcing the other rules ## What does the Security Rule ask for? The Security Rule asks for three kinds of safeguards: administrative, physical and technical. HHS states that it “requires implementation of appropriate administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of electronic protected health information.” In plain terms, think of three questions about your records: 1. **Administrative.** Who is in charge of privacy and security, and what do staff learn and sign? 2. **Physical.** Who can reach the server closet, the front desk screen and the paper charts? 3. **Technical.** How do you control logins, back up data and protect the network? HHS also points to a tool for risk assessment. The HHS Security Rule page says the tool is “useful in assisting small and medium-sized health care practices and business associates as they perform a risk assessment.” A risk assessment is a written look at where patient data lives and what could go wrong. An adviser can tell you what documentation your office needs. ## What is a plain HIPAA checklist for the office? A checklist helps a team see gaps. The items below are prompts for a conversation with an adviser. They are not a legal standard, and passing them does not prove compliance. Area Question to ask People Does one person own privacy and security tasks? Training Do new hires and current staff get privacy training, and is it written down? Inventory Do we know every system that holds patient data, including [practice management software](https://joncopeland.multisites.ai/glossary/practice-management-software)? Risk Have we done a written risk assessment, and when did we last update it? Access Does each person have their own login with only the access the job needs? Backups Do we have backups, and do we test a restore? Vendors Do we have a written contract with each vendor that handles patient data? Incidents Does the team know who to tell if something goes wrong? ## What about vendors that touch patient data? A vendor that handles patient data for your office is often a business associate, and HHS expects a written contract. HHS states that “a business associate may use or disclose protected health information only as permitted or required by its business associate contract or as required by law.” A [business associate agreement](https://joncopeland.multisites.ai/glossary/business-associate-agreement) is that contract. Offices usually need one for software hosts, billing services and similar vendors. Ask your adviser which of your vendors need one, and keep copies where the office manager can find them. ## What happens after a breach? HHS says that after a breach of unsecured protected health information, covered entities “must provide notification of the breach to affected individuals, the Secretary, and, in certain circumstances, to the media.” The timing depends on size. Situation HHS timing (Breach Notification Rule) Notice to affected individuals Without unreasonable delay, no later than 60 days after discovery Breach of 500 or more people Notify HHS without unreasonable delay, no later than 60 days Breach of fewer than 500 people HHS notice may be given annually, within 60 days after year end More than 500 residents of one state Notice to prominent media outlets, same 60-day limit An office that has a plan before a breach can move faster. The related post on [ransomware and data breaches](https://joncopeland.multisites.ai/blog/dental-ransomware-data-breach) covers response steps. Always confirm deadlines with an attorney, because state laws can add duties. ## Who in the office should own HIPAA tasks? One named person keeps tasks from falling through. In many offices, that is the [office manager](https://joncopeland.multisites.ai/glossary/office-manager) or [practice manager](https://joncopeland.multisites.ai/glossary/practice-manager), working with the owner dentist and an outside adviser. A short written job description for the role helps, and so does a yearly calendar date for review. HHS also runs email lists for OCR privacy and security guidance, and the HHS HIPAA page invites readers to sign up. ## Where does this fit in a wider compliance plan? HIPAA is one of several areas that a dental office tracks. OSHA covers workplace safety and CDC covers infection control. The [dental compliance checklist](https://joncopeland.multisites.ai/guides/dental-compliance-checklist) puts the areas side by side. The posts on [OSHA requirements](https://joncopeland.multisites.ai/blog/osha-requirements-dental-offices) and [CDC infection control](https://joncopeland.multisites.ai/blog/cdc-infection-control-dental-settings) cover the other two. The glossary also explains [risk management](https://joncopeland.multisites.ai/glossary/risk-management). ## Next step For the full picture, read the [dental compliance checklist](https://joncopeland.multisites.ai/guides/dental-compliance-checklist). To ask about consulting, [contact Dr. Copeland about consulting](https://joncopeland.multisites.ai/contact?topic=consulting). ## Frequently asked questions ### What is HIPAA compliance for a dental office? It means following the HIPAA Privacy, Security and Breach Notification Rules for patient health information. The rules apply to health care providers who conduct certain electronic transactions, which includes many dental offices. A qualified adviser can confirm how they apply to a specific office. ### Does HIPAA require a security risk assessment? The HHS Security Rule page points small and medium-sized practices to a risk assessment tool, and the Security Rule asks for safeguards to protect electronic patient information. Ask a HIPAA adviser what documentation your office needs. ### When must a dental office report a breach? HHS says affected individuals must be told without unreasonable delay and within 60 days of discovery. Breaches of 500 or more people also go to HHS within 60 days. Smaller breaches may be reported to HHS yearly. Confirm timing with an adviser. ## Terms on this page - [Business associate agreement](https://joncopeland.multisites.ai/glossary/business-associate-agreement) - [Practice management software](https://joncopeland.multisites.ai/glossary/practice-management-software) - [Compliance checklist](https://joncopeland.multisites.ai/glossary/compliance-checklist) - [Infection control](https://joncopeland.multisites.ai/glossary/infection-control) - [Practice manager](https://joncopeland.multisites.ai/glossary/practice-manager) - [Job description](https://joncopeland.multisites.ai/glossary/job-description) - [Risk management](https://joncopeland.multisites.ai/glossary/risk-management) - [Office manager](https://joncopeland.multisites.ai/glossary/office-manager) - [Ransomware](https://joncopeland.multisites.ai/glossary/ransomware) - [HIPAA](https://joncopeland.multisites.ai/glossary/hipaa) ## Sources 1. [HHS: HIPAA for Professionals](https://www.hhs.gov/hipaa/for-professionals/index.html) 2. [HHS: The Security Rule](https://www.hhs.gov/hipaa/for-professionals/security/index.html) 3. [HHS: Breach Notification Rule](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html) 4. [HHS: Business Associate Contracts](https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html) Written by Copeland Consulting Services and checked against the sources above on October 26, 2026. Rules, data and guidance change, so check the linked page before you act on it. ## Keep reading - [Dental practice compliance checklist: OSHA, HIPAA and infection controlA dental compliance checklist covers three federal areas: OSHA workplace safety, HIPAA privacy and security, and CDC infection control. OSHA has no dentistry-specific standard but applies general industry standards such as bloodborne pathogens. HIPAA covers patient information. Use the checklist to organize questions, then confirm requirements with your own advisers.](https://joncopeland.multisites.ai/guides/dental-compliance-checklist) - [Ransomware and data breaches: steps for a dental practiceFederal guidance says to keep offline, encrypted backups, test restores and keep a written incident response plan. HHS says a ransomware attack on patient data is presumed a breach unless the office shows a low probability of compromise. CISA says to report incidents to CISA or the FBI. Confirm duties with an adviser.](https://joncopeland.multisites.ai/blog/dental-ransomware-data-breach) - [CDC infection control in dental settings: the basicsCDC's Summary of Infection Prevention Practices in Dental Settings sets out basic expectations for safe care. It rests on Standard Precautions and the 2003 CDC guidelines. It applies to all dental health care personnel, and it includes a checklist offices can use to evaluate compliance. This is education, not legal advice.](https://joncopeland.multisites.ai/blog/cdc-infection-control-dental-settings) - [OSHA requirements for dental offices: a plain overviewOSHA says there are no specific OSHA standards for dentistry. General industry standards still apply to hazards found in dental offices. The Bloodborne Pathogens Standard, 29 CFR 1910.1030, requires an exposure control plan and a sharps injury log. This is education, not legal advice. Confirm duties with an adviser.](https://joncopeland.multisites.ai/blog/osha-requirements-dental-offices) - [AI scribes for dental notes: questions to ask a vendorAn AI scribe listens to a visit and drafts notes, so it handles patient information. HHS says a vendor that creates, receives, maintains or transmits protected health information for a practice is generally a business associate, which calls for a written agreement. Ask about data use, storage, errors, review, and exit terms before signing.](https://joncopeland.multisites.ai/blog/ai-dental-scribe-questions) - [Dental associate contracts: terms, pay models and red flags to ask aboutA dental associate contract sets pay, status, duties, term, termination, insurance and limits on work after you leave. The ADA publishes a guide to key provisions and a compensation explainer. Pay models differ in what they count, so read the formula. Have an attorney in your state review any contract before you sign.](https://joncopeland.multisites.ai/guides/dental-associate-contracts) ## Talk with Dr. Copeland [Contact Dr. Copeland](https://joncopeland.multisites.ai/contact)[Email](mailto:drcopeland@joncopelanddds.com)