Does HIPAA Apply to Dentists?

Last reviewed November 2026 against 45 CFR Parts 160 and 164.

Short answer: almost always, yes. HIPAA applies to a dental practice that sends health information electronically for any standard insurance transaction: electronic claims, eligibility and benefit checks, claim status, or electronic payment and remittance. It applies whether the practice sends them itself or through a billing service or clearinghouse. Nearly every practice that accepts dental insurance does this.

Why: the "covered entity" test

HIPAA's rules apply to "covered entities". For providers, that means a health care provider who transmits health information in electronic form in connection with a transaction for which HHS has adopted a standard (45 CFR 160.103, definition of "covered entity"). Dentists are health care providers, and electronic dental claims and eligibility checks are standard transactions.

Once a practice is a covered entity, HIPAA covers all of its patients' identifiable health information, on paper, on screen or spoken, not just the information sent electronically.

The narrow exception

A practice that never conducts any standard transaction electronically, directly or through anyone acting for it (for example a cash-only practice that gives patients paper receipts and never bills insurance electronically), is not a HIPAA covered entity. That's rare. If you're relying on it, check with an attorney, because:

• a single electronic claim or eligibility check sent by you or a billing company brings the practice in;
• state privacy and records laws still apply either way.

What it means for a small dental office

A covered dental practice must follow three sets of rules:

• The Privacy Rule: how you use and share patient information, and patients' rights: to get copies of their records, to ask for corrections, to get a list of certain disclosures, and to receive your Notice of Privacy Practices.
• The Security Rule: safeguards for electronic information (practice software, digital X-rays, email, backups, phones), starting with a documented risk analysis.
• The Breach Notification Rule: what to do, and by when, if patient information is lost, stolen or sent to the wrong person.

The rules are scaled to the practice: a two-dentist office isn't expected to look like a hospital (164.306(b)). But the written policies, training records and risk analysis are required at any size. See the full checklist.

Who in the office it covers

Everyone in your "workforce": dentists, hygienists, assistants, front desk, office manager, temps, students and volunteers (160.103, "workforce"). Outside companies that handle patient information for you, such as your cloud practice software, IT provider, billing company or shredding service, are business associates and need a signed business associate agreement.

Common questions

Are dental X-rays and intraoral photos covered?

Yes. Any health information that identifies a patient is protected health information, including images, periodontal charts, treatment plans and billing records.

Are dental insurers covered by HIPAA too?

Dental plans and insurers are generally "health plans" under HIPAA, so they are covered entities in their own right. Sharing information with them for payment is allowed without the patient's written authorization.

Do I need a Notice of Privacy Practices?

Yes. Give it to each new patient at the first visit, make a good-faith effort to get a signed acknowledgment, post it in the office, and post it on your website if you have one (164.520).

Can we text appointment reminders?

Yes. Reminders are part of treatment and operations. Keep them to the minimum (name, time, practice phone), use practice-controlled phones or a vendor with a business associate agreement, and respect a patient's request to be contacted another way.

Does my dental lab need a business associate agreement?

Usually not. A lab that receives information to make an appliance for your patient is receiving it for treatment, which the business associate definition excludes. Signing one anyway does no harm.