The Practical HIPAA Compliance Checklist for Dental & Small Medical Practices

Solo and small dental, orthodontic, dermatology, therapy, and primary-care practices — anywhere between 1 and roughly 25 employees. If you have a compliance officer with a full toolkit, you already know most of this. If you are the owner, the office manager, or the IT person your practice hired part-time, this is for you.

Everything below is drawn from the HHS regulations and the actual OCR resolution agreements — the settlements HHS has published for practices that got caught. The patterns repeat. Fix the patterns and you eliminate most of your risk.

Almost certainly yes. If your practice bills insurance electronically, transmits eligibility checks or claims, or exchanges patient information with anyone digitally, you are a covered entity under HIPAA. That includes cash-only cosmetic practices that still run electronic eligibility checks.

Being small does not exempt you. OCR has settled cases against two-dentist practices and single-provider clinics for six-figure amounts.

This is the section OCR asks about first. Every item here has to be documented in writing. A verbal “yes, we do that” does not count.

• ✓Security Risk Analysis (SRA), completed within the last 12 months. A written assessment of where ePHI lives (practice management system, imaging server, backup drives, staff phones) and what could go wrong. This is the single most common HIPAA violation — no SRA on file.
• ✓Written HIPAA policies and procedures. Access management, sanction policy for staff violations, password policy, mobile device policy, remote access, incident response, contingency plan. A single binder or shared drive is fine.
• ✓Named Security Officer and Privacy Officer. Can be the same person in a small practice, and can be the owner. Put it in writing with a date.
• ✓Workforce training log. Every person with access to ePHI — including part-time hygienists, temps, and the person who does your billing offsite — trained within their first 30 days and refreshed annually. Log the date, topic, and signature.
• ✓Sanction policy applied consistently. Written policy for what happens when a staff member violates HIPAA (curious lookups, sharing passwords, taking photos of the schedule). Enforced the same way for everyone.
• ✓Business Associate Agreements (BAAs) with every vendor that touches PHI. Practice management vendor, billing service, IT contractor, cloud backup, secure email provider, transcription service, appointment reminder service, waste-disposal vendor if they see charts. If they can see PHI, you need a signed BAA on file.

These are the boring, tangible controls that keep paper charts, monitors, and hardware out of the wrong hands. Auditors love them because they are easy to verify by walking through the office.

• ✓Front-desk monitor angles. The screen showing the schedule should not be readable from the waiting room. Privacy filters cost about $30 and eliminate the problem.
• ✓Workstation lock timeout. Every workstation locks after 10–15 minutes of inactivity, without exception, including the doctor's operatory computers.
• ✓Server or NVR closet locked. If your practice management server or imaging server sits in an unlocked closet or under a desk, that is a Security Rule finding waiting to happen. Lock it, restrict the key.
• ✓Facility access log. Who has keys, alarm codes, and after-hours access. Removed within 24 hours when someone leaves.
• ✓Device disposal policy. Old workstations, imaging plates, phones — wiped or shredded, with a certificate of destruction from the vendor. Do not donate old computers with the drives in them.
• ✓Paper record disposal. Locked shred bins, or in-office cross-cut shredders. Regular trash is not acceptable for anything with a patient name on it.

What actually runs on your computers. If you have an IT contractor, most of this lives with them — but you own it, so you need to be able to answer these questions.

• ✓Unique user accounts for every staff member. Nobody shares a login. If your practice management system has a shared ‘front desk’ login, that alone is a HIPAA violation.
• ✓Multi-factor authentication (MFA) enabled. On email, remote access, the practice management system if it supports it, and any cloud storage. This is the single most effective control against the ransomware attacks that took down two dental practices per week in 2025.
• ✓Full-disk encryption on every device. Windows BitLocker or Mac FileVault. A stolen unencrypted laptop with any PHI on it is a reportable breach — encryption is the safe-harbor exception.
• ✓Encrypted email for anything containing PHI. Regular Gmail or Outlook is not compliant on its own. Use a HIPAA-compliant email service or a secure patient portal.
• ✓Automatic backups, tested at least quarterly. Backups you have never restored are not backups. Restore a test file every quarter and log the date.
• ✓Audit logs turned on and reviewed. Your practice management system logs who viewed which chart. Even a monthly spot-check on a handful of records demonstrates you are watching.
• ✓Antivirus and OS patching. Automatic updates on every device. No workstations running Windows versions past end-of-support. This is table stakes and it still lands people in resolution agreements.

Privacy Rule violations are the ones patients file complaints about. OCR is required to investigate every complaint they receive, so these matter even without an audit.

• ✓Notice of Privacy Practices (NPP). Posted in the waiting area, on your website, and handed to every new patient. Signed acknowledgment or good-faith documentation on file.
• ✓Minimum necessary. Staff only see the parts of a chart they need for their role. Front desk does not need clinical notes from three years ago to schedule a cleaning.
• ✓Patient right of access. Patients can request a copy of their records within 30 days at a reasonable fee (search for the current OCR guidance on fees — the ceiling is low). This is the single most-complained-about issue.
• ✓Authorization for anything outside treatment/payment/operations. Marketing, testimonials, before-and-after photos on social media, referring a patient to a partner practice — signed authorization on file.
• ✓No PHI in confirmation texts or voicemails without opt-in. “This is Dr. Smith’s office confirming Tuesday at 3” is fine. “Reminder about your extraction” is not, unless the patient has agreed.
• ✓Complaint process documented. Patients need somewhere to file a HIPAA complaint. Publish it. Log every complaint received and how it was resolved.

If PHI is lost, stolen, or improperly disclosed and it is unsecured (i.e., not encrypted), you have to report it. Small breaches roll up into an annual report. Breaches affecting 500 or more patients require notifying HHS, prominent media, and every affected patient within 60 days.

• ✓Written breach response plan. Who to call, in what order, when something happens. Include your IT contractor, your cyber insurance carrier, and legal counsel.
• ✓Cyber liability insurance in force. A ransomware event at a small practice runs $50k–$250k all-in. Insurance is not optional in 2026 — verify your policy covers regulatory response.
• ✓Notification templates ready. Draft patient letters, HHS notification, and media notice sitting in a folder — so you are not writing them at 11 p.m. on a Friday during an actual incident.
• ✓Documented risk assessment for every incident. Not every improper disclosure is a reportable breach. Document why you concluded a low probability of compromise if you decide not to notify. That analysis is what OCR wants to see.

Block three hours. Do it in this order:

1. Section 2 (administrative). Pull out whatever policy documents you have. If you cannot produce them, that is the first gap.
2. Section 6 vendor list. Write down every vendor that touches PHI. Note which ones have a signed BAA on file.
3. Walk the office with Sections 3 and 4 in hand. Look at screen angles, workstation locks, server closet, backup tapes, paper-record disposal.
4. Sections 5 and 7. Grab your Notice of Privacy Practices, your training log, and your incident response plan.
5. Write down every “missing” item as a task. Assign each one an owner and a due date. This document — the list of gaps and remediation plan — is itself a HIPAA artifact and will help you enormously in a real audit.

VylintShield generates the written HIPAA documents a small practice needs from a short questionnaire about your practice: the risk assessment, the incident response plan, the compliance checklist, and the access-control, data-handling, and staff-security-awareness policies — written against the HIPAA Security Rule, not a generic template. You assemble them into your compliance program, and they are yours to keep. If you finished the walkthrough above and made a list of gaps, the platform produces the artifacts to close each one.

It is not the point of this article. If the checklist is enough for you, use it. It is on the internet for anyone who wants it.