Dental practice compliance checklist: OSHA, HIPAA and infection control

This guide turns three federal sources into a working checklist: OSHA for workplace safety, HHS for HIPAA and the CDC for infection control. It is general education from Copeland Consulting Services. It is not legal advice and it is not a complete list. Rules change, states add their own, and the right answer depends on your office. Confirm requirements with the agencies, your attorney and your compliance adviser. Treat each row below as a question to ask, not a finding about your practice.

What does a dental compliance checklist cover?

A dental compliance checklist covers the rules that apply to how a practice protects its workers, its patients’ information and its patients’ health. In the federal system, three bodies matter most: the Occupational Safety and Health Administration (OSHA), the Department of Health and Human Services (HHS) and the Centers for Disease Control and Prevention (CDC). Each looks at a different risk.

Many practices also face state dental board rules, state privacy laws and insurer requirements. Those are outside this guide. The Missouri Dental Board and a Missouri attorney are the places to check state rules.

What does OSHA require of a dental office?

OSHA sets workplace safety rules, and it says there are currently no specific OSHA standards for dentistry. It adds that many hazards that may apply to dentistry are addressed by specific OSHA standards for general industry. The agency lists bloodborne pathogens, pharmaceuticals and other chemical agents, ergonomic hazards, noise, vibration and workplace violence among the hazards dental professionals may face.

The bloodborne pathogens standard, 29 CFR 1910.1030, is the one most dental offices work with every day. The OSHA glossary entry gives the short version. The bloodborne pathogens standard entry explains the terms. Key elements in the standard’s text include:

1. A written Exposure Control Plan. Each employer with an employee who has occupational exposure must establish one, designed to eliminate or minimize employee exposure.
2. Annual review. The plan must be reviewed and updated at least annually and whenever tasks, procedures or positions change.
3. Training. The employer must train each employee with occupational exposure at no cost to the employee and during working hours. Training happens at initial assignment and at least annually after that.
4. Hepatitis B vaccine. The employer must make the vaccine and the vaccination series available to employees with occupational exposure. It must be offered within 10 working days of initial assignment, after training, unless the employee has already received it. Post-exposure evaluation and follow-up must be offered after an exposure incident.
5. Sharps injury log. The employer must keep a log of percutaneous injuries from contaminated sharps, kept in a way that protects the injured employee’s confidentiality.

The standard also defines the controls: engineering controls such as sharps disposal containers and safer devices, and work practice controls that change how a task is done. Read the standard itself, since this summary leaves out details such as recordkeeping periods and labeling.

OSHA also has an overview page for dentistry with links to guides for medical and dental offices. Start there when you look for training aids. The post on OSHA requirements for dental offices goes deeper.

What does HIPAA require?

HIPAA is a federal privacy and security law, and HHS publishes three rules that matter to a dental office. HHS says the Privacy Rule applies to health plans, clearinghouses and health care providers that conduct certain health care transactions electronically. Many dental offices that bill electronically are in that last group. Ask your attorney to confirm how HIPAA applies to your office.

HHS gives breach timing rules. Individual notice must go out without unreasonable delay and no later than 60 days after the breach is discovered. If a breach affects 500 or more individuals, HHS must be told within the same 60 days. For breaches affecting fewer than 500, a covered entity may notify HHS on an annual basis. Rules for media notice and state law add steps. Ask your attorney.

The HHS Security Rule page also refers to business associates. A business associate agreement is the usual contract with a vendor that handles patient data. See the entries on HIPAA and the HIPAA Security Rule. The post on HIPAA for dental offices covers the day-to-day questions. For related risks, see dental ransomware and data breaches.

What does the CDC say about infection control?

The CDC publishes a summary of basic infection prevention expectations for safe care in dental settings. The page says the summary brings together CDC recommendations from the 2003 Guidelines for Infection Control in Dental Health-Care Settings and other CDC recommendations published since. It says the 2003 guidelines are archived but continue to serve as the standard of practice for clinical dentistry.

The CDC page reaffirms Standard Precautions as the foundation for preventing the spread of infectious agents during care in all dental settings. It also says all dental settings, regardless of the level of care, must make infection prevention a priority and should be equipped to observe Standard Precautions and the other recommendations in the 2003 guidelines. The glossary entries on infection control and standard precautions define the terms.

CDC guidance is not a regulation by itself. State dental boards, OSHA and other bodies may point to it. The post on CDC infection control in dental settings lists the topics the CDC covers.

What does the checklist look like in one table?

Use this table as a starting list. Fill in the owner and the date for each row, then review it on a set schedule. The table lists questions, not findings.

What records should a practice keep?

Keep records that show what you did and when. The sources name a few record types directly, and your advisers will name others. Store the files where the person who owns the checklist can reach them.

Retention periods differ by record and by state. Ask your attorney how long to keep each type.

Who should own the checklist?

Name one person to own the checklist and one person to back them up. The owner does not do every task. The owner makes sure each row has a name, a date and a status. In a small practice, that is often an office manager or the practice owner. A larger group may use a compliance officer. See practice manager and office manager for the roles.

Three habits help. Put the review on the calendar. Report the status at a team meeting each quarter. Give the team a way to raise a concern without blame.

How often should the checklist be reviewed?

Review it on a set schedule and after any change. The one review interval the sources state is OSHA’s: the Exposure Control Plan must be reviewed and updated at least annually. For the other rows, set your own schedule with your advisers. Also review after a new hire, a new vendor, a new software system, an exposure incident or a change in state rules.

A simple review rhythm:

1. Quarterly: check that open items have owners and dates.
2. Annually: complete training, review the Exposure Control Plan and update policies.
3. After any incident: write down what happened and what changed.

Keep records in one place so you can show them when asked. Do not store patient information in the compliance binder itself. Add the checklist to your standard operating procedures and your risk management routine. For a broader view of how compliance fits with the rest of the business, see compliance checklist.

Where does compliance fit in practice management?

Compliance is part of how a practice runs each day, not a separate project. Training, records and written policies belong with onboarding, team meetings and the employee handbook. A new team member’s first week is the natural time for OSHA training, as covered in the guide to hiring and keeping a dental team. The pillar on dental practice management covers the wider systems.

Next step

For the wider system view, read the pillar on dental practice management. To talk about practice questions, contact Dr. Copeland about consulting. Dr. Jon Copeland, DDS, is a general dentist in Wildwood, Missouri.