HIPAA documentation for dental practices. Built in 30 days.

Yes, with one nuance. A dental practice is a covered entity under HIPAA if it transmits any health information electronically in connection with a HIPAA-covered transaction (electronic claims, eligibility checks, electronic remittance advice). Almost every modern dental practice does at least one of these, which puts the practice in scope. The Privacy Rule, the Security Rule, and the Breach Notification Rule all apply, and OCR investigates dental practices on the same complaint and audit pathways as physician offices.

Yes. A dental lab that receives a prescription with patient identifiers (name, date of birth, case number tied to a chart) is creating, receiving, or transmitting PHI on your behalf, which makes the lab a business associate under 45 CFR § 160.103. The same is true for milling centers, oral pathology labs, sleep apnea labs, and AI-assisted radiograph review services. The package includes a BAA register, a model BAA, and a workflow for executing and renewing each agreement.

HIPAA preempts less protective state law and is preempted by more protective state law. State dental boards typically set retention periods (often 6 to 10 years past the patient's last visit, longer for minors), which override HIPAA's silent default. The package includes a Records Retention Policy that reflects your state's specific dental board rule, and a hand-off to your malpractice insurer's record-keeping requirements where they exceed state law.

State dental boards also impose record-release rules that overlap with HIPAA's right of access. The package documents the practice's procedure so OCR's Right of Access Initiative and the state board's parallel rule are both satisfied with the same workflow.

Cone beam CT (CBCT) systems and 3D intraoral scanners produce identifiable patient images that are PHI. They typically run on a dedicated workstation with their own database, separate from the practice management system. The Imaging System Inventory in the package documents the scanner, the workstation, the storage location, the encryption posture, the access list, and the retention rule. Practices that ignore the imaging server in their Risk Analysis are the most common dental finding in OCR investigations.

Yes. Multi-location practice groups have additional scope: shared servers, inter-office VPN, cross-location clinician schedules, and patient charts visible from any office. The Multi-Location Boundary documentation maps the data flow between offices, defines the network controls, and writes a workforce access policy that tracks who can see which patients across the group. Pricing is scoped to total employees and locations rather than charging per-location, so a 6-office group is materially less expensive than buying six single-location programs.

HIPAA-aligned does not mean unrealistic. Sign-in sheets at the front desk, casual confirmation of next visit by name, and an open operatory are all things OCR has accepted with the right minimum-necessary controls and patient acknowledgment. The package writes down the practice's actual workflow, the controls that make it HIPAA-aligned, and the documentation a state inspector or OCR investigator can read in five minutes without you needing to re-engineer your office.

The Offboarding and Access Revocation procedure is one of the most-used pieces of the package because dental staff turnover is real. It walks through account deactivation in the practice management system, imaging system, email, cloud backup, building access, and any cloud apps the employee touched, with a sign-off form that protects the practice if the former employee later complains they could not get their pay records, or if they later attempt to access data after termination. The accompanying confidentiality agreement is a one-page document new hires sign on day one.

Yes, with a documented minimum-necessary control. OCR has not banned sign-in sheets, but unidentified information beyond name and arrival time triggers a privacy issue. The package's Front Desk Privacy Standard documents what the sign-in sheet may include, the chart-pickup procedure, the operatory privacy practice, and how the practice handles the patient who calls a partner or family member to discuss treatment in the lobby. The intention is to make routine practice operations defensibly compliant without rewriting the office.