A new HIPAA checklist for dental and chiropractic offices spells out exactly what email and file sharing must satisfy under the Security Rule, and why encryption decides breach notification.
PreVeil published a HIPAA checklist aimed specifically at dental and chiropractic practices that send protected health information by email and share files with specialists, payers and patients. The guide is grounded in the federal standards at 45 CFR Part 164, the same Security Rule a hospital follows, scaled to the size of a small office. Any regulated practice that emails X-rays, treatment plans, imaging reports or claims correspondence should care, because the checklist clarifies which requirements are mandatory, which are addressable, and what happens after an incident depending on whether PHI was encrypted.
Key Takeaways
- HIPAA applies to a dental or chiropractic office because a provider who transmits health information electronically in connection with a covered transaction, such as an electronic claim, is a covered entity under 45 CFR 160.103.
- Audit controls are required for every covered entity regardless of size under 164.312(b), so an email system that keeps no activity record cannot support the rule.
- Encryption is addressable, not required, under 164.312(a)(2)(iv) and (e)(2)(ii), but PHI encrypted consistent with HHS guidance is not "unsecured" under 164.402, so a lost laptop or compromised mailbox holding it does not trigger breach notification.
- Every vendor that creates, receives, maintains or transmits PHI for the office needs a business associate agreement, including the email provider, cloud storage, practice management software, billing company and outside IT provider.
- Every office must name a security official under 164.308(a)(2); in a small practice this is usually the owner or office manager, and the role cannot be left unassigned.
What happened: the facts in detail
The checklist and its structure
The PreVeil article lays out a 12-item checklist covering the requirements that apply most directly to email and file sharing in a dental or chiropractic office. Each item is tied to its section of 45 CFR Part 164 and marked as either required or addressable. The items draw on the administrative safeguards in 164.308, the physical safeguards in 164.310 and the technical safeguards in 164.312, citing the primary regulation text at the Electronic Code of Federal Regulations.
The checklist covers risk analysis that includes email and file sharing, documented decisions on encryption for stored and sent PHI, device and media disposal, logging and activity review, and the policies the office itself must write and own. Two rules sit across the entire list: policies and documented decisions must be kept for six years from the date they were created or last in effect under 164.316(b)(2)(i), and a breach of unsecured PHI requires notice to affected patients within 60 calendar days of discovery under 164.404(b).
What "addressable" actually means
A recurring point of confusion the article addresses is the meaning of "addressable." An addressable specification is not optional in the everyday sense. Under 164.306(d)(3), the office must assess the specification and then either adopt it, adopt an equivalent measure, or write down why neither is reasonable for the practice. The decision must be documented either way.
The rule also builds in proportionality. Section 164.306(b)(2) lets an office weigh the size, complexity and capabilities of the practice and the costs of security measures when choosing how to apply each standard. A small office can choose simpler measures, but each standard still applies. The Security Rule sets the floor, not a menu.
Who is accountable
Every office must identify the security official responsible for developing and implementing the policies and procedures the Security Rule requires, per 164.308(a)(2). The article notes that in a dental or chiropractic office this is usually the owner or the office manager, sometimes with help from an outside IT provider. The security official owns the risk analysis, the vendor list and business associate agreements, the review of activity records and the incident procedures.
One detail practices frequently miss: an outside IT provider that can reach PHI is itself a business associate and needs its own business associate agreement. HHS guidance on HIPAA and cloud computing goes further, stating that a cloud provider storing electronic PHI is a business associate even if it cannot view the data.
What the risk analysis must contain
Under 164.308(a)(1)(ii)(A), a required specification, the risk analysis must be an accurate and thorough assessment of the risks to PHI. For email and file sharing, the article says the analysis should list where PHI travels, who receives it, how it is protected in transit and at rest, and what happens if a mailbox or laptop is compromised.
For a dental office, the typical flows are X-rays and treatment plans sent to oral surgeons and orthodontists, claims correspondence with dental plans, and records requests from other providers. A chiropractic office sends imaging reports, receives referrals from primary care physicians, and sends records to payers and to attorneys handling injury claims. Each flow belongs in the analysis next to the safeguard the office chose for it.
Encryption and audit logs
The article explains why two technical items carry the most weight for office email. Audit controls under 164.312(b) are required, and an email system that keeps no activity record cannot support them. Regular review of activity records is also required under 164.308(a)(1)(ii)(D). Encryption is addressable, but it determines the consequences of an incident: under 164.402, PHI encrypted consistent with HHS guidance is not "unsecured," so a compromised mailbox or lost laptop holding it does not trigger breach notification.
HHS guidance on rendering unsecured PHI unusable, unreadable or indecipherable adds that decryption tools should be stored on a device or at a location separate from the data they encrypt or decrypt. The article describes PreVeil as built that way, with encryption keys staying on users' devices, message contents and attachments encrypted on the sender's device, and PreVeil unable to access or decrypt the office's email or files. The company states its cryptographic modules are FIPS 140-3 validated under certificate #5145, and that it signs a business associate agreement with healthcare practices.
How the HIPAA checklist works and why it matters
The checklist is best read as a mapping exercise: every place PHI moves in the practice gets a row, and every row gets a citation, a required-or-addressable designation and a documented decision. That structure matters because the Security Rule is not a product you buy. The office still owns its policies, training, backups and risk analysis even when vendors supply the technical safeguards.
For a business reader, the practical logic is straightforward. Required specifications, such as audit controls and the risk analysis, are non-negotiable at any practice size. Addressable specifications, chiefly encryption, must be assessed and the outcome written down. The payoff for adopting encryption is concrete: properly encrypted PHI that is lost does not trigger the 60-day patient notification obligation, because it is not "unsecured" under the rule. HHS has proposed Security Rule changes that would make encryption required, which would remove that discretion entirely.
The article also answers a question many practices get wrong: email itself is not prohibited. An HHS FAQ on sending electronic PHI by email says the Security Rule does not expressly prohibit it. The office must assess the risk, apply safeguards such as encryption and document the decision.
Practices that want a broader view of the rule, including the 18 standards across administrative, physical and technical safeguards, can consult NIST SP 800-66 Rev. 2, which provides practical guidance for regulated entities of all sizes on safeguarding electronic PHI and maps the Security Rule to NIST frameworks.
What the evidence does and does not show
The checklist is vendor-published guidance, not an HHS document. Its citations to 45 CFR Part 164 can be verified against the regulation text at the Electronic Code of Federal Regulations, and the article is consistent with the primary sources on the points it raises. But it is a checklist for email and file sharing, not a complete compliance program; physical safeguards, workforce training detail and contingency planning appear only as checklist rows, not as full guidance.
Several things remain open. The proposed Security Rule changes that would make encryption required have not been finalized, so the current addressable status stands. The article does not state how HHS Office for Civil Rights enforcement prioritizes small dental and chiropractic practices, and it does not quantify breach risk for these office types. There is also no HHS-issued HIPAA certification a practice can obtain; documentation aligned to NIST SP 800-66 Rev. 2 and the HHS Office for Civil Rights audit protocol is the available benchmark.
Finally, the checklist's own division of labor is worth noting: items marked as the office's responsibility, such as policies and incident investigation, cannot be delegated to a vendor. The office's security official owns them regardless of which email or file sharing product is in place.
Compliance and Risk Implications for Regulated Organizations
The checklist published by PreVeil is written for dental and chiropractic offices, but the compliance logic it applies scales far beyond a solo practice. The Security Rule's structure at 45 CFR Part 164, with required standards, addressable specifications, and a documented decision for each, is the same structure every regulated organization works under. An addressable specification is not optional: the office must adopt it, adopt an equivalent measure, or document why neither is reasonable, per 45 CFR 164.306. That documentation discipline is what auditors and plaintiffs look for first, and it is where most small organizations are weakest.
Three implications stand out for any regulated business reading this checklist.
- Encryption status determines breach exposure. Under 164.402, PHI encrypted consistent with HHS guidance is not "unsecured," so a lost laptop or compromised mailbox holding properly encrypted data does not trigger the breach notification obligations at 164.404. That single fact changes the economics of an incident more than any other control choice.
- Audit controls are required, not addressable. 164.312(b) applies to every covered entity regardless of size. An email or file sharing system that keeps no activity record cannot support the required review of activity records under 164.308(a)(1)(ii)(D). If your systems cannot answer "who accessed what, when," you have a gap, not a preference.
- Vendors inherit your obligations. Every vendor that creates, receives, maintains or transmits PHI for the practice needs a business associate agreement, including the email provider, cloud storage, practice management software, billing company, and any outside IT provider that can reach PHI. HHS guidance on cloud computing says a cloud provider storing electronic PHI is a business associate even if it cannot view the data.
The proposed Security Rule update matters here too. Encryption is addressable under the current rule, but HHS has proposed changes that would make it required. Organizations that documented a decision to skip encryption because it was addressable should expect that defense to expire. Building encryption in now, while it is still a documented choice rather than a mandate, is the cheaper path.
For organizations juggling multiple frameworks, the overlap is significant. The fact that NIST SP 800-66 Rev. 2 exists specifically to help regulated entities of all sizes implement the Security Rule, with mappings to the NIST Cybersecurity Framework, means a single well-documented control set can serve HIPAA and other obligations at once. NIST SP 800-171, for example, requires FIPS-validated cryptography to protect the confidentiality of controlled unclassified information, which is the same architectural instinct as encrypting PHI end to end. PCI DSS similarly centers encryption and access control around cardholder data. The control work is not duplicated; the evidence is.
What This Means for Regulated Industries
Defense Contractors
The parallel is direct. A dental office deciding whether to encrypt PHI in email is making the same risk-based decision a contractor makes about controlled unclassified information in email and file sharing. DFARS 252.204-7012 requires reporting a cyber incident affecting covered defense information to DoD within 72 hours of discovery, which is far tighter than HIPAA's 60 calendar days for patient notice. Contractors should also note the pattern in DOJ Civil Cyber-Fraud Initiative settlements, including Raytheon's $8.4M settlement in May 2025 and Georgia Tech's $875K settlement in September 2025: misrepresenting your security posture carries financial consequences independent of the breach itself. If your self-assessment score posted to the Supplier Performance Risk System does not match reality, the exposure is fraud, not just noncompliance.
Healthcare
Small practices are the audience for this checklist, and the enforcement environment is not forgiving of size. HHS OCR actions in 2024 and 2025 included a $548,265 civil money penalty against Children's Hospital Colorado in December 2024, where multi-factor authentication had been disabled, and a $3M settlement with Solara in January 2025. The scale of third-party risk is also visible in the numbers: business associates accounted for about 66% of breached healthcare records in 2024, and there were 725 large healthcare breaches that year. A small practice cannot control its vendors' security, but it can control its vendor list, its BAAs, and its choice of encrypted channels. The checklist's insistence on naming a security official under 164.308(a)(2) is the right starting point; in most small practices that role is unassigned, and an unassigned role is an unmet requirement.
Legal
Law firms handling injury claims, records requests, and settlement correspondence sit in the same data flows the checklist describes. A chiropractic office sending records to attorneys handling injury claims is one of the named flows, and the attorney receiving them is handling health information under confidentiality duties of their own. Firms should apply the same test: know where sensitive data travels, ensure the transport is encrypted, confirm audit logging exists, and execute the equivalent vendor agreements. A firm that receives PHI from a provider client should verify that the provider's transmission method is defensible, because a firm's own disclosure obligations do not pause while it waits for a client to fix theirs.
Financial Services
Financial firms touch this story through their business associate and vendor management obligations rather than through HIPAA directly. Advisors, lenders, and payment processors serving healthcare practices receive PHI in loan packages, merchant agreements, and benefits administration. The checklist's vendor logic applies in reverse: if you receive PHI from healthcare clients, you are likely a business associate, you need the agreement in place, and you need to pass equivalent terms down to your subcontractors under 164.504(e)(2) and 164.314(a)(2)(i). Firms subject to PCI DSS should recognize the shared architecture: encrypt sensitive data, log access, review the logs, and document the decisions.
An Action Plan for This Month
Security and IT leaders can act on this checklist immediately. The steps below are ordered so each builds on the last.
- Name the security official in writing. Identify the person responsible for developing and implementing security policies under 164.308(a)(2). In a small organization this is usually the owner or office manager, sometimes supported by an outside IT provider. Document the designation.
- Map every PHI or sensitive data flow through email and file sharing. List what is sent, to whom, and how: X-rays to specialists, claims to payers, records to attorneys, referrals from physicians. Each flow gets a row in the risk analysis.
- Inventory every vendor that touches the data. Include the email provider, cloud storage, practice management software, billing company, and any outside IT provider that can reach PHI. HHS guidance treats cloud providers as business associates even when they cannot view the data.
- Verify a signed BAA exists for each vendor on that list. The agreement must require Security Rule compliance for electronic PHI, breach reporting for unsecured PHI, and flow-down terms to subcontractors.
- Test whether your email and file systems keep activity records. Audit controls under 164.312(b) are required. If the system cannot produce a record of who accessed what and when, that is a finding to remediate, not a documentation gap to explain.
- Decide and document encryption for data at rest and in transit. Cite 164.312(a)(2)(iv) and (e)(2)(ii) and the addressable mechanism at 164.306(d)(3): adopt it, adopt an equivalent, or write down why neither is reasonable. Given the proposed rule changes, documenting a decision against encryption is a position with a short shelf life.
- Confirm decryption keys are stored separately from the data. HHS guidance says decryption tools should be stored on a device or at a location separate from the data they encrypt or decrypt. End-to-end encrypted systems where keys stay on user devices satisfy this by design.
- Check the six-year documentation rule. Policies and documented decisions must be kept for six years from creation or last effect under 164.316(b)(2)(i). If your risk analysis is older than your current email system, it is stale and needs a refresh.
- Rehearse the incident path. Walk through what happens if a mailbox or laptop is compromised: is the PHI secured, does notice under 164.404(b) apply within 60 calendar days, who makes that call? Write the answer down before the incident.
- Schedule the annual review. The risk analysis must be an "accurate and thorough assessment" under 164.308(a)(1)(ii)(A), which means it is a living document. Put the next review on the calendar now, with the security official as owner.
How Petronella Technology Group, Inc. Helps
Petronella Technology Group, Inc. works with regulated organizations that face exactly the obligations this checklist describes. Our HIPAA compliance services help healthcare practices and their associates build the documentation backbone the Security Rule demands: risk analysis, policies, vendor and BAA management, and evidence aligned to NIST SP 800-66 Rev. 2 and the HHS Office for Civil Rights audit protocol. There is no HHS-issued HIPAA certification, so the documentation is the compliance, and it is what we build and maintain.
For organizations that need a named, qualified security official without a full-time executive hire, our vCISO service provides a named security officer of record for HIPAA under 45 CFR 164.308(a)(2), with formal designation documentation, a written current-state assessment within 30 days, and a 90 to 180 day remediation roadmap written for the executive reader. The first quarterly board memo lands at day 75 to 90.
Our managed security and MDR capability addresses the required audit controls directly: 24/7 monitoring, AI-powered detection with human-led investigation, and logging every action for HIPAA and CMMC audit. Reporting is designed to provide the evidence auditors need for HIPAA, CMMC, PCI DSS, SOC 2, and NIST 800-171 verification, and our private AI cluster serves healthcare and defense clients that cannot send PHI or CUI to a public-cloud SOC.
Broader context and checklists are available in our compliance hub, including the HIPAA Compliance Checklist 2026 and the HIPAA Risk Assessment Checklist. For teams that need to train staff on handling PHI by email, our CMMC, HIPAA and cybersecurity training covers the human layer the technical controls depend on.
Related reading
- HIPAA Compliance Services
- HIPAA Compliance Checklist for NC Healthcare Practices 2026
- HIPAA Compliance Requirements: Complete 2026 Guide
- HIPAA Compliance for Cloud Computing: A Guide
- HIPAA Breach Notification Guide
Sources
- HIPAA checklist for dental and chiropractic offices
- eCFR :: 45 CFR 164.306 -- Security standards: General rules.
- eCFR :: 45 CFR 164.308 -- Administrative safeguards.
- eCFR :: 45 CFR 164.310 -- Physical safeguards.
- 45 CFR Part 164 - Subpart C - Security Standards for the Protection of Electronic Protecte
- SP 800-66 Rev. 2, Implementing the Health Insurance Portability and Accountability Act (HI
Frequently Asked Questions
Is encryption actually required for HIPAA-compliant email in a dental office?
Not under the current rule, but the decision must be documented. Encryption is addressable under 164.312(a)(2)(iv) and (e)(2)(ii), so the office must adopt it, adopt an equivalent measure, or write down why neither is reasonable. Because properly encrypted PHI that is lost does not trigger breach notification, and HHS has proposed making encryption required, most offices are better served by adopting it now.
Can a small practice use regular email for PHI if it documents the risk?
Yes, with conditions. The HHS FAQ on sending electronic PHI by email says the Security Rule does not expressly prohibit it, but the office must assess the risk, apply safeguards such as encryption, and document the decision. An email system with no activity record will still fail the required audit controls under 164.312(b).
Does our IT provider need a business associate agreement?
Yes, if the provider can reach PHI. Any vendor that creates, receives, maintains or transmits PHI for the office is a business associate, and an outside IT provider with access to systems holding PHI fits that definition. The BAA must require Security Rule compliance, breach reporting for unsecured PHI, and flow-down terms to subcontractors.
Who is the security official in a small practice?
Usually the owner or office manager, sometimes supported by an outside IT provider. The role cannot be left unassigned: 164.308(a)(2) requires identifying the security official responsible for developing and implementing the required policies and procedures. That person owns the risk analysis, the vendor list and BAAs, the review of activity records, and the incident procedures.
What happens if encrypted PHI is lost or a mailbox is compromised?
Under 164.402, PHI encrypted consistent with HHS guidance is not "unsecured," so its loss does not trigger breach notification to affected patients under 164.404(b). This is the strongest practical argument for encryption: it converts a reportable breach into a security incident handled internally. The encryption must be consistent with HHS guidance, including storing decryption tools separate from the data.
How long must we keep HIPAA policies and documented decisions?
Six years from the date they were created or last in effect, under 164.316(b)(2)(i). This applies to the risk analysis, the encryption decision, the vendor list, and the security official designation. A document that has not been reviewed since your last email migration is out of date even if it is within the retention window.
If your office needs help turning this checklist into documented, defensible compliance, call Penny, our AI assistant, at 919-348-4912 to book a consultation, or reach Petronella Technology Group, Inc. through our contact form.
Free, practical, and specific to regulated environments. We will email it to you.
No spam. Unsubscribe anytime.
