HIPAA for dental practices
What a dental office needs in place under HIPAA: when it applies, the notice and records-request rules, online reviews, and the vendors that need a business associate agreement.
On this page
HIPAA for dental practices: at a glance
A dental practice is a HIPAA covered entity if it, or a billing service acting for it, sends health information electronically in a standard transaction such as an insurance claim — which most practices that accept dental insurance do. Covered dental offices need a documented risk analysis, a Notice of Privacy Practices posted in the office and on the website, BAAs with vendors that are business associates, and timely responses to patients' requests for records. OCR has taken enforcement action against dental practices for revealing patient details in replies to online reviews.
| HIPAA applies if | You or your billing service submit insurance claims or other standard transactions electronically |
|---|---|
| Notice of Privacy Practices | Posted in the office and on the practice website; good-faith effort to get a signed acknowledgment |
| Records requests | Respond within 30 days; OCR has settled right-of-access cases with dental practices |
| Online reviews | Replies must not confirm someone is a patient or reveal treatment details |
| Vendors that usually need a BAA | Practice management or imaging software in the cloud, email, texting and reminders, billing services |
Does HIPAA apply to your dental office?
HIPAA applies to a health care provider that transmits health information electronically in connection with a standard transaction — submitting a dental claim, checking eligibility or receiving a remittance electronically (45 CFR 160.103). Transactions your billing service submits for you count. Most practices that accept dental insurance are covered entities; a practice that is fully cash-pay and never conducts these transactions, directly or through anyone else, may not be. If you are unsure, run through Does HIPAA apply?.
What is different about a dental office
The front desk is where most disclosures happen. Sign-in sheets and calling patients by name in the waiting room are allowed under HHS guidance, as long as you share only what is needed and use reasonable safeguards — for example, a sign-in sheet that does not ask for the reason for the visit. These are “incidental” disclosures, not violations, when the minimum necessary standard and safeguards are in place.
Your Notice of Privacy Practices must be visible. As a direct treatment provider you must give the notice at the first visit, make a good-faith effort to get a written acknowledgment, post it in a clear and prominent place in the office, and post it on your website if you have one (45 CFR 164.520(c)). See Notice of Privacy Practices.
Patients ask for their records and X-rays. You must act on a request within 30 days, and you can charge only a reasonable, cost-based fee for copies (45 CFR 164.524). OCR has settled several right of access cases with dental practices that were slow or refused to provide records. Sending records or X-rays to another dentist for the patient’s treatment does not need a release form (45 CFR 164.506(c)(2)); for other recipients, see the free dental records release form.
Sharing images with specialists is treatment. Sending X-rays or charts to an oral surgeon, orthodontist or lab for treatment does not need the patient’s authorization (45 CFR 164.506). It does need a secure way to send them.
Online reviews: the dental-specific trap
OCR has taken action against at least three dental practices for revealing patient information in replies to online reviews — a $10,000 settlement (Elite Dental Associates, 2019), a $23,000 settlement (New Vision Dental, 2022) and a $50,000 civil money penalty (Dr. U. Phillip Igbinadolor, D.M.D. & Associates, 2022). Confirming that a reviewer is your patient is itself a disclosure of PHI.
We recommend a short, written review policy: thank the reviewer, say you can’t discuss anyone’s care publicly, and invite them to call the office.
What to put in place first
- A written risk analysis covering the practice management system, imaging software and devices, email, texting and reminder services, and backups.
- BAAs with every vendor that is a business associate — typically cloud practice management or imaging software, IT support with access to systems, reminder and texting services, email, and billing services.
- One login per person on the practice management and imaging systems, so access can be traced and removed when someone leaves.
- Your Notice of Privacy Practices given, acknowledged, posted in the office and on the website.
- A records-request process that meets the 30-day deadline, and a review-reply policy.
- Staff training for every new hire and when your policies change.
Main risks
- Replying to an online review in a way that confirms the reviewer is a patient or mentions their treatment.
- Missing the 30-day deadline when a patient asks for a copy of their records or X-rays.
- No documented risk analysis covering the practice management system, imaging, email and reminder tools.
- Cloud practice management, imaging or reminder services used without a signed BAA.
- Shared front-desk logins, so nobody can tell who opened or changed a record.
Requirements that matter most here
- Security risk analysis →§ 164.308(a)(1)(ii)(A)Every covered entity and business associate must document an accurate and thorough assessment of risks to the ePHI it holds — and then act on it. It is one of the most commonly missing pieces of HIPAA compliance, including in small practices.
- Notice of Privacy Practices →§ 164.520What the Notice of Privacy Practices must say, when and how a practice must provide it, where it must be posted, and what changed in 2026.
- Right of access →§ 164.524Patients' right to see and get copies of their health records: deadlines, formats, fees, third-party requests, and what a small practice needs in place.
- Business associate agreements (BAAs) →§ 164.502(e)A vendor that creates, receives, maintains or transmits PHI on your behalf is generally a business associate, and you need a signed BAA with it before it touches patient data. No BAA means you should not put PHI in that tool.
- Minimum necessary →§ 164.502(b)What the HIPAA minimum necessary standard requires, when it does not apply, and how small practices put it into practice with role-based access and standard disclosure limits.
- Access control and sign-in →§ 164.312(a)(1)Only the right people should reach ePHI, each under their own account, with a reliable way to confirm who is signing in. In practice: unique user accounts, strong authentication such as MFA, and automatic logoff.
- HIPAA training requirements →§ 164.530(b)Who must be trained under HIPAA, on what, how often, and how to document it — and what the rule does not actually require.
- Notifying patients of a breach →§ 164.402An impermissible use or disclosure of unsecured PHI is presumed to be a breach unless a documented four-factor assessment shows a low probability of compromise. Affected individuals must be notified without unreasonable delay and no later than 60 days after discovery.
Solutions to look at
- Practice management and EHR →ToolPractice management and EHR systems for therapy and small medical practices — how each puts its BAA in place, from which plan, and what that agreement covers.
- Patient texting and messaging →ToolPhone, text and messaging platforms for practices that sign a BAA — what's included in the price, how the agreement is put in place, and what to watch for when texting patients. A BAA is necessary for a vendor that handles PHI, but it does not by itself make texting patients secure or appropriate — that also depends on your own safeguards and policies.
- HIPAA email services →ToolEmail services that sign a BAA, compared on what actually protects patient messages — and what you still have to configure yourself.
- Cloud storage and file sharing →ToolCloud storage services that sign a BAA — on which plans, how you put the agreement in place, and what you must configure before storing patient files.
- Online HIPAA training courses →ToolOnline HIPAA training for staff — what each course covers, how long it takes, what it costs, and whether owners get completion records that help document the workforce training HIPAA requires.
- HIPAA compliance software →ToolPlatforms that help you run a HIPAA program — policies, risk analysis, staff training and vendor BAAs in one place — compared on what they actually include and whether they publish prices.
If something happens
- You had a data breach →A misdirected email, a lost laptop, a hacked mailbox. What to do, in order, in the first days — and the deadlines that start running when you discover it.
- HIPAA training for new employees — and the rest of onboarding →What HIPAA training a new employee needs, when, and how to document it — plus the access steps when someone joins your practice or company and when they leave.
- You received a letter from OCR →A complaint investigation or compliance review from the HHS Office for Civil Rights. What the letter means, what to send, and how these cases usually end.
Your path to compliance
- Confirm HIPAA applies to you and in which role — Does HIPAA apply?
- Put the requirements above in place, starting with a documented risk analysis.
- Choose how to do the work — yourself, with templates, software, a consultant or an attorney — compare every route.
Frequently asked questions
Can a dental office use a patient sign-in sheet?
HHS guidance says yes, as long as it asks only for the information needed and the practice uses reasonable safeguards — for example, not listing the reason for the visit.
Can a dentist reply to a bad online review?
Only without revealing anything about the person's care — not even that they are a patient. OCR has taken action over replies that disclosed patient information, including $10,000 and $23,000 settlements and a $50,000 civil money penalty.
Do I need patient consent to send X-rays to a specialist?
No. HIPAA permits sharing PHI with another provider for treatment without the patient's authorization. Send it securely; keeping a note of what you sent is good practice, though HIPAA doesn't require logging treatment disclosures.
Do appointment reminders by text need a BAA?
If a vendor sends the reminders for you using patient information, it is a business associate and you need a BAA with it.