--- title: "Dental Practice Compliance Checklist: OSHA, HIPAA, CDC" description: "A dental practice compliance checklist built from OSHA, HHS HIPAA and CDC sources: exposure control plan, training, privacy, security and breach rules." url: https://joncopeland.multisites.ai/guides/dental-compliance-checklist publisher: Copeland Consulting Services email: drcopeland@joncopelanddds.com contact: https://joncopeland.multisites.ai/contact --- # Dental practice compliance checklist: OSHA, HIPAA and infection control A dental compliance checklist covers three federal areas: OSHA workplace safety, HIPAA privacy and security, and CDC infection control. OSHA has no dentistry-specific standard but applies general industry standards such as bloodborne pathogens. HIPAA covers patient information. Use the checklist to organize questions, then confirm requirements with your own advisers. GuideUpdated October 26, 20268 min read 1. 1 ## OSHA has no dental standard OSHA says there are no specific standards for dentistry, but general industry standards such as bloodborne pathogens apply to dental hazards. 2. 2 ## Written plan, annual training The bloodborne pathogens standard calls for a written Exposure Control Plan and for training at initial assignment and at least annually. 3. 3 ## HIPAA has three rules to know HHS publishes the Privacy Rule, the Security Rule and the Breach Notification Rule for covered entities. 4. 4 ## CDC sets the baseline CDC says all dental settings must make infection prevention a priority and observe Standard Precautions. This guide turns three federal sources into a working checklist: OSHA for workplace safety, HHS for HIPAA and the CDC for infection control. It is general education from Copeland Consulting Services. It is not legal advice and it is not a complete list. Rules change, states add their own, and the right answer depends on your office. Confirm requirements with the agencies, your attorney and your compliance adviser. Treat each row below as a question to ask, not a finding about your practice. ## What does a dental compliance checklist cover? A dental compliance checklist covers the rules that apply to how a practice protects its workers, its patients’ information and its patients’ health. In the federal system, three bodies matter most: the Occupational Safety and Health Administration (OSHA), the Department of Health and Human Services (HHS) and the Centers for Disease Control and Prevention (CDC). Each looks at a different risk. Area Agency What it protects Where to start Workplace safety OSHA Employees [OSHA dentistry page](https://www.osha.gov/dentistry) Patient information HHS Office for Civil Rights Patients [HIPAA for professionals](https://www.hhs.gov/hipaa/for-professionals/index.html) Infection prevention CDC Patients and the team [CDC dental summary](https://www.cdc.gov/dental-infection-control/hcp/summary/index.html) Many practices also face state dental board rules, state privacy laws and insurer requirements. Those are outside this guide. The Missouri Dental Board and a Missouri attorney are the places to check state rules. ## What does OSHA require of a dental office? OSHA sets workplace safety rules, and it says there are currently no specific OSHA standards for dentistry. It adds that many hazards that may apply to dentistry are addressed by specific OSHA standards for general industry. The agency lists bloodborne pathogens, pharmaceuticals and other chemical agents, ergonomic hazards, noise, vibration and workplace violence among the hazards dental professionals may face. The bloodborne pathogens standard, 29 CFR 1910.1030, is the one most dental offices work with every day. The [OSHA](https://joncopeland.multisites.ai/glossary/osha) glossary entry gives the short version. The [bloodborne pathogens standard](https://joncopeland.multisites.ai/glossary/bloodborne-pathogens-standard) entry explains the terms. Key elements in the standard’s text include: 1. **A written Exposure Control Plan.** Each employer with an employee who has occupational exposure must establish one, designed to eliminate or minimize employee exposure. 2. **Annual review.** The plan must be reviewed and updated at least annually and whenever tasks, procedures or positions change. 3. **Training.** The employer must train each employee with occupational exposure at no cost to the employee and during working hours. Training happens at initial assignment and at least annually after that. 4. **Hepatitis B vaccine.** The employer must make the vaccine and the vaccination series available to employees with occupational exposure. It must be offered within 10 working days of initial assignment, after training, unless the employee has already received it. Post-exposure evaluation and follow-up must be offered after an exposure incident. 5. **Sharps injury log.** The employer must keep a log of percutaneous injuries from contaminated sharps, kept in a way that protects the injured employee’s confidentiality. The standard also defines the controls: engineering controls such as sharps disposal containers and safer devices, and work practice controls that change how a task is done. Read the standard itself, since this summary leaves out details such as recordkeeping periods and labeling. OSHA also has an overview page for dentistry with links to guides for medical and dental offices. Start there when you look for training aids. The post on [OSHA requirements for dental offices](https://joncopeland.multisites.ai/blog/osha-requirements-dental-offices) goes deeper. ## What does HIPAA require? HIPAA is a federal privacy and security law, and HHS publishes three rules that matter to a dental office. HHS says the Privacy Rule applies to health plans, clearinghouses and health care providers that conduct certain health care transactions electronically. Many dental offices that bill electronically are in that last group. Ask your attorney to confirm how HIPAA applies to your office. Rule What HHS says it does Practical question Privacy Rule Sets national standards to protect medical records and other individually identifiable health information, called protected health information Who may see patient records, and who decides? Security Rule Requires administrative, physical and technical safeguards to protect the confidentiality, integrity and availability of electronic protected health information Where is electronic patient data kept, and who guards it? Breach Notification Rule Requires covered entities to notify affected individuals, and HHS, after a breach of unsecured protected health information Who decides if an incident is a breach, and who sends notices? HHS gives breach timing rules. Individual notice must go out without unreasonable delay and no later than 60 days after the breach is discovered. If a breach affects 500 or more individuals, HHS must be told within the same 60 days. For breaches affecting fewer than 500, a covered entity may notify HHS on an annual basis. Rules for media notice and state law add steps. Ask your attorney. The HHS Security Rule page also refers to business associates. A [business associate agreement](https://joncopeland.multisites.ai/glossary/business-associate-agreement) is the usual contract with a vendor that handles patient data. See the entries on [HIPAA](https://joncopeland.multisites.ai/glossary/hipaa) and the [HIPAA Security Rule](https://joncopeland.multisites.ai/glossary/hipaa-security-rule). The post on [HIPAA for dental offices](https://joncopeland.multisites.ai/blog/hipaa-for-dental-offices) covers the day-to-day questions. For related risks, see [dental ransomware and data breaches](https://joncopeland.multisites.ai/blog/dental-ransomware-data-breach). ## What does the CDC say about infection control? The CDC publishes a summary of basic infection prevention expectations for safe care in dental settings. The page says the summary brings together CDC recommendations from the 2003 Guidelines for Infection Control in Dental Health-Care Settings and other CDC recommendations published since. It says the 2003 guidelines are archived but continue to serve as the standard of practice for clinical dentistry. The CDC page reaffirms Standard Precautions as the foundation for preventing the spread of infectious agents during care in all dental settings. It also says all dental settings, regardless of the level of care, must make infection prevention a priority and should be equipped to observe Standard Precautions and the other recommendations in the 2003 guidelines. The glossary entries on [infection control](https://joncopeland.multisites.ai/glossary/infection-control) and [standard precautions](https://joncopeland.multisites.ai/glossary/standard-precautions) define the terms. CDC guidance is not a regulation by itself. State dental boards, OSHA and other bodies may point to it. The post on [CDC infection control in dental settings](https://joncopeland.multisites.ai/blog/cdc-infection-control-dental-settings) lists the topics the CDC covers. ## What does the checklist look like in one table? Use this table as a starting list. Fill in the owner and the date for each row, then review it on a set schedule. The table lists questions, not findings. Area Checklist question Source to read Owner Last reviewed OSHA Is there a written Exposure Control Plan that is reviewed at least annually? 29 CFR 1910.1030(c) OSHA Does every employee with occupational exposure get training at assignment and at least annually? 29 CFR 1910.1030(g) OSHA Is the hepatitis B vaccine offered, and are post-exposure steps written down? 29 CFR 1910.1030(f) OSHA Is a sharps injury log kept with employee privacy protected? 29 CFR 1910.1030(h) HIPAA Do you know which workforce members can see which records? HHS Privacy Rule HIPAA Are electronic patient data protected with administrative, physical and technical safeguards? HHS Security Rule HIPAA Do you have a written plan for who decides on and sends breach notices? HHS Breach Notification Rule HIPAA Does each vendor that handles patient data have a business associate agreement? HHS Security Rule Infection control Have you read the CDC summary of basic expectations? CDC summary page Infection control Does the team know your Standard Precautions procedures? CDC summary page All Are training sessions logged with dates, topics and names? Your policies All Does an attorney or compliance adviser review the file each year? Your adviser ## What records should a practice keep? Keep records that show what you did and when. The sources name a few record types directly, and your advisers will name others. Store the files where the person who owns the checklist can reach them. Record Why it matters Source Exposure Control Plan with review dates OSHA requires a written plan reviewed at least annually 29 CFR 1910.1030(c) Training sessions: date, topics, attendees OSHA requires training at assignment and at least annually 29 CFR 1910.1030(g) Hepatitis B vaccine offers and responses OSHA requires the vaccine to be made available 29 CFR 1910.1030(f) Sharps injury log OSHA requires a log kept to protect employee confidentiality 29 CFR 1910.1030(h) Business associate agreements HHS refers to business associates in the Security Rule HHS Security Rule Breach decisions and notices HHS sets notice timing for breaches HHS Breach Notification Rule Retention periods differ by record and by state. Ask your attorney how long to keep each type. ## Who should own the checklist? Name one person to own the checklist and one person to back them up. The owner does not do every task. The owner makes sure each row has a name, a date and a status. In a small practice, that is often an office manager or the practice owner. A larger group may use a compliance officer. See [practice manager](https://joncopeland.multisites.ai/glossary/practice-manager) and [office manager](https://joncopeland.multisites.ai/glossary/office-manager) for the roles. Three habits help. Put the review on the calendar. Report the status at a team meeting each quarter. Give the team a way to raise a concern without blame. ## How often should the checklist be reviewed? Review it on a set schedule and after any change. The one review interval the sources state is OSHA’s: the Exposure Control Plan must be reviewed and updated at least annually. For the other rows, set your own schedule with your advisers. Also review after a new hire, a new vendor, a new software system, an exposure incident or a change in state rules. A simple review rhythm: 1. **Quarterly:** check that open items have owners and dates. 2. **Annually:** complete training, review the Exposure Control Plan and update policies. 3. **After any incident:** write down what happened and what changed. Keep records in one place so you can show them when asked. Do not store patient information in the compliance binder itself. Add the checklist to your [standard operating procedures](https://joncopeland.multisites.ai/glossary/standard-operating-procedure) and your [risk management](https://joncopeland.multisites.ai/glossary/risk-management) routine. For a broader view of how compliance fits with the rest of the business, see [compliance checklist](https://joncopeland.multisites.ai/glossary/compliance-checklist). ## Where does compliance fit in practice management? Compliance is part of how a practice runs each day, not a separate project. Training, records and written policies belong with onboarding, team meetings and the employee handbook. A new team member’s first week is the natural time for OSHA training, as covered in the [guide to hiring and keeping a dental team](https://joncopeland.multisites.ai/guides/hire-and-keep-a-dental-team). The pillar on [dental practice management](https://joncopeland.multisites.ai/guides/dental-practice-management) covers the wider systems. ## Next step For the wider system view, read the pillar on [dental practice management](https://joncopeland.multisites.ai/guides/dental-practice-management). To talk about practice questions, [contact Dr. Copeland about consulting](https://joncopeland.multisites.ai/contact?topic=consulting). Dr. Jon Copeland, DDS, is a general dentist in Wildwood, Missouri. ## Frequently asked questions ### What does OSHA require in a dental office? OSHA says no specific standards exist for dentistry. General industry standards cover dental hazards, and the bloodborne pathogens standard is a key one. It calls for a written Exposure Control Plan, training, hepatitis B vaccine availability and a sharps injury log. Confirm the full list with OSHA or an adviser. ### Does HIPAA apply to my dental practice? HHS says the Privacy Rule applies to health plans, clearinghouses and health care providers that conduct certain health care transactions electronically. Most dental practices that bill insurance electronically fall in that group. Ask your attorney or compliance adviser to confirm how HIPAA applies to your office. ### How soon must a data breach be reported? HHS says covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured protected health information. Breaches affecting 500 or more people also go to HHS within 60 days. Smaller breaches may be reported annually. Ask your attorney. ### What are CDC infection control guidelines for dentistry? CDC publishes a summary of basic infection prevention expectations for safe care in dental settings. It reaffirms Standard Precautions as the foundation and builds on the 2003 CDC guidelines. CDC says all dental settings must make infection prevention a priority. Read the summary page and its linked guidance. ### How often should training happen? OSHA's bloodborne pathogens standard says training must happen at initial assignment and at least annually after that, at no cost to the employee and during working hours. HIPAA and infection control training schedules come from your policies and advisers. Keep dated records of each session. ## Terms on this page - [Bloodborne pathogens standard](https://joncopeland.multisites.ai/glossary/bloodborne-pathogens-standard) - [Business associate agreement](https://joncopeland.multisites.ai/glossary/business-associate-agreement) - [Dental practice management](https://joncopeland.multisites.ai/glossary/dental-practice-management) - [Missouri Dental Board](https://joncopeland.multisites.ai/glossary/missouri-dental-board) - [Compliance checklist](https://joncopeland.multisites.ai/glossary/compliance-checklist) - [Standard precautions](https://joncopeland.multisites.ai/glossary/standard-precautions) - [HIPAA Security Rule](https://joncopeland.multisites.ai/glossary/hipaa-security-rule) - [Employee handbook](https://joncopeland.multisites.ai/glossary/employee-handbook) - [Infection control](https://joncopeland.multisites.ai/glossary/infection-control) - [Practice manager](https://joncopeland.multisites.ai/glossary/practice-manager) ## Sources 1. [OSHA: Dentistry, Overview](https://www.osha.gov/dentistry) 2. [OSHA: 1910.1030, Bloodborne pathogens](https://www.osha.gov/laws-regs/regulations/standardnumber/1910/1910.1030) 3. [HHS: The HIPAA Privacy Rule](https://www.hhs.gov/hipaa/for-professionals/privacy/index.html) 4. [HHS: The Security Rule](https://www.hhs.gov/hipaa/for-professionals/security/index.html) 5. [HHS: Breach Notification Rule](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html) 6. [CDC: Summary of Infection Prevention Practices in Dental Settings, Basic Expectations for Safe Care](https://www.cdc.gov/dental-infection-control/hcp/summary/index.html) Written by Copeland Consulting Services and checked against the sources above on October 26, 2026. Rules, data and guidance change, so check the linked page before you act on it. ## Keep reading - [OSHA requirements for dental offices: a plain overviewOSHA says there are no specific OSHA standards for dentistry. General industry standards still apply to hazards found in dental offices. The Bloodborne Pathogens Standard, 29 CFR 1910.1030, requires an exposure control plan and a sharps injury log. This is education, not legal advice. Confirm duties with an adviser.](https://joncopeland.multisites.ai/blog/osha-requirements-dental-offices) - [HIPAA for dental offices: a plain checklist for ownersHIPAA has three rules most dental offices must know: the Privacy Rule, the Security Rule and the Breach Notification Rule. The Security Rule asks for administrative, physical and technical safeguards for electronic patient information. After a breach, notice goes to patients and HHS, and sometimes the media. Ask a qualified adviser about your office.](https://joncopeland.multisites.ai/blog/hipaa-for-dental-offices) - [Dental practice management: people, money, schedule, patients and complianceDental practice management is the business side of running a dental office: finances, scheduling, patient communication, insurance decisions, team systems and legal compliance. Track a few core numbers, build written systems, review them on a set schedule, and use federal and ADA sources for compliance basics.](https://joncopeland.multisites.ai/guides/dental-practice-management) - [CDC infection control in dental settings: the basicsCDC's Summary of Infection Prevention Practices in Dental Settings sets out basic expectations for safe care. It rests on Standard Precautions and the 2003 CDC guidelines. It applies to all dental health care personnel, and it includes a checklist offices can use to evaluate compliance. This is education, not legal advice.](https://joncopeland.multisites.ai/blog/cdc-infection-control-dental-settings) - [Ransomware and data breaches: steps for a dental practiceFederal guidance says to keep offline, encrypted backups, test restores and keep a written incident response plan. HHS says a ransomware attack on patient data is presumed a breach unless the office shows a low probability of compromise. CISA says to report incidents to CISA or the FBI. Confirm duties with an adviser.](https://joncopeland.multisites.ai/blog/dental-ransomware-data-breach) - [How to hire and keep a dental teamDental team hiring is hard because the supply of assistants and hygienists is tight. ADA Health Policy Institute research links retention to workplace culture, work-life balance and fair pay. Write job ads and interview questions around the job's duties, and ask an employment attorney before you finalize hiring and pay policies.](https://joncopeland.multisites.ai/guides/hire-and-keep-a-dental-team) ## Talk with Dr. Copeland [Contact Dr. Copeland](https://joncopeland.multisites.ai/contact)[Email](mailto:drcopeland@joncopelanddds.com)