HIPAA Compliance for Dental Offices: The 2027 Checklist

For owner-dentists and office managers of 1–3 provider practices. Last reviewed November 2026 against the HIPAA regulations (45 CFR Parts 160 and 164).

Most small dental offices don't get into HIPAA trouble because of hackers. They get into trouble because a patient asked for their records, waited too long, and complained, and then the practice couldn't produce the paperwork the rules require. This page lists that paperwork and the rest of what a small office needs, in plain language, with the rule behind each item.

The four documents OCR asks for first

This is our reading of OCR's published enforcement actions against small practices, not an official OCR list. Each item rests on a clear requirement in the rules.

1. Written privacy and breach-notification policies and procedures. The practice must have written policies and procedures for the Privacy Rule and the Breach Notification Rule, and keep them for six years (45 CFR 164.530(i)–(j)).
2. A right-of-access procedure and a request log. Patients have a right to copies of their records, usually within 30 days (164.524). Missing this deadline is the most common way small practices end up in an OCR case. How records requests work.
3. A record of workforce training. Everyone on the team must be trained on your policies, and you must document that training (164.530(b)). What the training rule requires.
4. A documented security risk analysis, with evidence of what you fixed. The Security Rule requires an accurate and thorough assessment of the risks to electronic patient information, and measures to reduce them (164.308(a)(1)(ii)(A)–(B)).

The full checklist

Privacy Rule

• Name a Privacy Officer and a contact person for complaints (164.530(a)). In a small office one person, often the office manager, can also be the Security Officer.
• Have a current Notice of Privacy Practices: give it to new patients, ask them to acknowledge it, post it in the office and on your website (164.520). It needed updating for February 2026 (see "What changed" below).
• Written policies for uses and disclosures, minimum necessary, authorizations, patients' rights (access, amendment, accounting of disclosures, restrictions, confidential communications), complaints, sanctions and mitigation (164.502–164.530).
• A business associate agreement with every vendor that handles patient information for you: your cloud practice software, IT provider, billing service, shredding company (164.502(e), 164.504(e)). A dental lab that receives information to make a crown for the patient is usually not a business associate.
• Rules for patient photos, testimonials and replies to online reviews. Never confirm someone is a patient in a review reply.

Security Rule (electronic patient information)

• Name a Security Officer (164.308(a)(2)).
• Do the risk analysis and keep a risk-management plan with evidence (164.308(a)(1)). The free HHS Security Risk Assessment Tool helps with the analysis part.
• A security awareness and training program: reminders, malware protection, log-in monitoring, passwords (164.308(a)(5)).
• Unique logins, automatic log-off, and a decision on encryption for laptops, phones and email (164.312).
• Backups, a disaster-recovery plan and an emergency-mode plan, tested from time to time (164.308(a)(7)).
• Rules for devices and media: who has them, how they're wiped or destroyed (164.310(d)).
• "Addressable" items are not optional. You must either do them or write down why an alternative is reasonable for your practice (164.306(d)).

Breach Notification Rule

• A process to assess every possible breach and document the decision (164.402, 164.414).
• Notify affected patients without unreasonable delay and no later than 60 days after discovery (164.404).
• Report to HHS: breaches affecting fewer than 500 people go in an annual report due within 60 days after the end of the calendar year; 500 or more are reported at the same time as the patient notices (164.408).

Documentation

• Keep policies, training records, risk analyses, access logs, breach assessments and signed agreements for at least six years (164.530(j), 164.316(b)). This is separate from how long you keep clinical records, which your state sets.

What changed for 2027

• Notice of Privacy Practices. Since February 16, 2026, covered providers' notices must include information about substance-use-disorder records under 42 CFR Part 2. HHS published revised model notices in February 2026.
• The 2024 reproductive-health privacy rule was vacated by a federal court in June 2025, including three of its notice requirements. Some of its text still appears in the online regulations; don't build policies on it.
• The Security Rule overhaul is still a proposal. HHS proposed major changes in January 2025 (asset inventories, multi-factor authentication, encryption, annual audits). As of November 2026 they are not final; the federal regulatory agenda lists a target of July 2027. Today's rule is the one that's enforced.

Common questions

Is there such a thing as "HIPAA certified"?

No. HHS doesn't certify practices or products. Compliance means adopting the required policies, following them, and keeping the records that prove it.

Do I need compliance software?

No. The rules are technology-neutral and scaled to the size of the practice (164.306(b)). Many small offices meet them with written policies, a few spreadsheets and an annual review.

Is the free HHS risk assessment tool enough?

It helps with the risk analysis, which is one of the four documents. You still need written policies, a records-request procedure, training records, and evidence that you fixed what the analysis found.