HIPAA compliance checklist for dental offices: the 20 things that come up in real cases

Not because dentists are careless. Because a dental office has every HIPAA exposure a hospital has, in a building with eight staff and no IT department. Patient records in the practice management system, images on an imaging workstation, insurance details in the clearinghouse, paper charts in the back, a copier, a texting platform for reminders, a marketing vendor with the patient list, and a Google Business profile that invites replies.

The cases that reach a settlement are consistent. In 2026 a small rural dental practice paid $140,000 after a records-access complaint led OCR to find no written privacy policies, no formal HIPAA training, and paper records kept in clear plastic boxes on the floor and in a bathroom; OCR had calculated a $1.4 million penalty before reducing it by 90 percent for practice size. The same year a software vendor to dental practices paid $10,000 after a breach affecting roughly 15 million people, with no risk analysis. Earlier dental cases turned on review replies, records-access failures and a patient list handed to a marketing vendor.

Tick what's true today. The result tells you where to start.

A plastic bin in the bathroom is a safeguards finding. Yes, really. $140,000 worth.Your engineer

• The review reply. "We're sorry you felt that way about your crown" confirms the reviewer is a patient and names a procedure. OCR has settled three of these with dental practices since 2019. Reply generically or not at all.
• The imaging workstation. Panoramic and intraoral images are PHI, the workstation often runs an old operating system, and it's rarely in anyone's inventory or backup plan.
• The marketing vendor. Recall campaigns and review requests need the patient list. The vendor is a business associate and needs a BAA; several dental breaches have come through this channel.
• The front-desk login. One shared account for the whole front office means no audit trail and no way to remove a leaver without changing everyone's password.
• The copier. It has a hard drive full of insurance forms. When the lease ends, get the drive wiped in writing.

The risk analysis. Every other item on the list is easier once it exists, and it's the first document any investigation asks for. A small practice can have one in a few weeks with the right help. See what a risk analysis has to contain and what the program costs.