HIPAA Training for Dental Offices

What's required, how often, what to cover, and how to document it. Last reviewed November 2026.

Training is one of the first things OCR asks a small practice to show, and the record of it is often missing even when the training happened. Here's what the rules actually say, separated from what's simply good practice.

What the rules require

• Train every workforce member on your privacy policies, as needed for them to do their jobs. That includes dentists, hygienists, assistants, front desk, temps and students (45 CFR 164.530(b)(1)).
• Train each new team member within a reasonable period after they join (164.530(b)(2)(i)(B)).
• Retrain the people affected when your policies change materially, within a reasonable period after the change takes effect (164.530(b)(2)(i)(C)).
• Document that training was given (164.530(b)(2)(ii)), and keep the record for six years (164.530(j)).
• Run a security awareness and training program for all staff (164.308(a)(5)). It covers periodic security reminders, protection from malicious software, log-in monitoring and password management; these four are "addressable", which means you must do them or document a reasonable alternative.

How often? Annual training is recommended, not written into the rule

The Privacy Rule's text sets triggers (new hires and material changes), not a fixed yearly interval. Annual training for everyone is still the widely expected standard, and it's the easiest way to show your program is current. Our recommendation:

• new hires: before they access patient records, or within 14–30 days at most;
• everyone: a 20–30 minute refresher once a year, plus short security reminders (a monthly staff-meeting item works);
• after any incident or policy change: a targeted session for the people involved.

What to cover in a dental office

1. What counts as patient information: charts, X-rays and intraoral photos, schedules, billing, even a name on a sign-in sheet.
2. Minimum necessary: only look at and share what your job needs.
3. The front desk: sign-in sheets, screens facing the waiting room, phone calls and voicemails.
4. Patients' right to their records: every request is logged the same day; 30 days is the legal limit. How records requests work.
5. Texting and email: what's allowed, and when to use the patient portal.
6. Social media and online reviews: never confirm someone is a patient or discuss their care in a reply. See the 2019 dental case.
7. Phones, laptops, passwords and phishing.
8. Reporting: who to tell, immediately, about a lost phone, a misdirected email or a suspicious login.
9. Sanctions: what happens if someone breaks the rules.

How to document it

Keep a sign-off log with one row per person per session:

• name and role, start date;
• date trained, type (new hire, annual, policy change), the materials and version used;
• trainer, quiz score if you use one, and the trainee's initials or signature;
• for new hires, the signed confidentiality acknowledgment.

File it in your compliance binder with a copy of the materials used that year. If OCR asks "show us your training", that log is the answer.

Common questions

Is "HIPAA certification" training required?

No. HIPAA doesn't require any certificate or certified course. It requires training on your policies and a record that it happened.

Do the dentists need training too?

Yes. Owners and associate dentists are part of the workforce.

Can we combine HIPAA and OSHA training?

Many offices schedule them together. OSHA's requirements are separate and have their own rules; make sure each part is documented on its own.

Is a free online HIPAA video enough?

It can help with general awareness, but the rule is training on your practice's policies and procedures. Add a short session on how your office does things, and log it.