HIPAA compliance checklist for dental practices

Risk analysis and risk management

The first required administrative safeguard, 45 CFR §164.308(a)(1). OCR usually asks for it first.

• A written, dated security risk analysis covers every system that creates, receives, stores or sends ePHI: practice management, imaging, email, cloud backup, phones and patient messaging. Often missed
• An inventory lists every device and application that holds ePHI, including imaging workstations, chairside tablets, laptops and portable drives.
• Each threat and vulnerability has a likelihood, an impact and a risk level recorded.
• A risk management plan names the fix, the owner and a target date for every risk you are not formally accepting.
• The analysis is reviewed on a set schedule (many practices do it yearly) and again after a new system, a move or a new location.

Administrative safeguards

People, policies and procedures, 45 CFR §164.308 and §164.316.

• A security official is named in writing. It can be the same person as the privacy official.
• Written security policies and procedures are dated and kept for six years from when they were last in effect.
• Each workforce member can reach only the ePHI their job needs, and each account's access level is approved by name.
• New hires complete HIPAA training before or soon after they start, with a signed record on file.
• Refresher training and security reminders (phishing, passwords, how to report) happen on a schedule and are documented.
• A written sanction policy has been acknowledged by staff and is applied consistently.
• Access ends on a worker's last day: practice management, imaging, email, remote access, alarm codes and keys, with the date recorded. Often missed
• Someone reviews system activity, such as audit logs, login reports and user lists, on a regular schedule. Often missed
• A security incident procedure says how staff report a suspected incident and how it is investigated and logged.
• A contingency plan covers data backup, disaster recovery and running the office in emergency mode.
• Backups are encrypted and kept off-site or in the cloud, and a test restore has proven they work. Often missed
• A periodic evaluation confirms the written policies still match how the office actually works.

Physical safeguards

Facility, workstation and device controls, 45 CFR §164.310.

• The server, network equipment and backup drives sit in a locked space with a short list of key holders.
• After-hours entry, alarm codes and key holders are documented and updated whenever someone leaves.
• Front desk and operatory screens face away from patients or have privacy filters.
• Workstations lock automatically after a short idle period.
• Paper charts and films are locked away when not in use.
• Paper PHI is shredded, and the shredding vendor provides certificates of destruction.
• Hard drives, copier and scanner drives, and old phones are wiped or destroyed before disposal or reuse, and each one is logged. Often missed

Technical safeguards

Access, audit, integrity, authentication and transmission controls, 45 CFR §164.312.

• Every user has a unique login, with no shared "front desk" or "hygiene" accounts. Often missed
• Multi-factor authentication is on for email, remote access, cloud practice management and imaging, and every admin account.
• Passwords follow NIST SP 800-63B-4: at least 15 characters when a password is the only factor (8 with MFA), passphrases allowed, checked against lists of breached passwords, no forced periodic rotation, and changed at once on any sign of compromise.
• Laptops, tablets, phones and portable drives that hold ePHI are encrypted.
• PHI sent outside the office goes by encrypted email or a secure portal, not plain email.
• Audit logging is switched on in practice management, imaging and email, and the logs are kept.
• Practice management and imaging sessions time out automatically.
• An emergency access procedure explains how to reach records if the usual system or person is unavailable.
• Operating systems and software are patched promptly, and unsupported systems are replaced or isolated.
• Anti-malware protection runs on every workstation and server.
• A managed firewall is in place, and remote access uses only a secured, approved method.
• Patient and guest Wi-Fi is separate from the network that carries practice systems.

Business associate agreements

Required before any vendor handles PHI on your behalf, 45 CFR §164.308(b) and §164.504(e).

• A current list names every vendor that creates, receives, stores or sends PHI for the practice.
• A signed BAA is on file for each one: IT support, cloud software and backup, email hosting, billing and collections, answering service, shredding and record storage. Often missed
• Patient reminder, texting, review and online-scheduling tools are on the list, with BAAs signed. Often missed
• Each BAA requires the vendor to report breaches and security incidents to you and to bind its own subcontractors.
• When a vendor relationship ends, PHI is returned or destroyed and that is confirmed in writing.

Breach notification

The Breach Notification Rule, 45 CFR §§164.400–414. State laws may add stricter deadlines.

• Staff know who to tell about a suspected breach, and they tell that person the same day.
• A written procedure assesses each incident with the rule's four-factor risk assessment to decide whether it is a reportable breach.
• Every incident is logged, including those judged not to be breaches, with the reasoning recorded.
• Affected patients are notified without unreasonable delay and no later than 60 calendar days after discovery.
• For a breach affecting 500 or more people, HHS is notified within the same 60 days, and prominent media are notified when 500 or more residents of one state or jurisdiction are affected.
• Breaches affecting fewer than 500 people are reported to HHS within 60 days after the end of the calendar year. Often missed
• Your state's breach notification law has been checked and added to the procedure.

Patient rights and privacy

Privacy Rule items OCR enforces alongside the Security Rule, 45 CFR §164.520, §164.524 and §164.530.

• A privacy official is named in writing.
• The Notice of Privacy Practices is posted in the office and on the website and given to new patients, and acknowledgment is requested.
• Records requests go into a log with the date received, date due, date fulfilled and a named owner. Often missed
• Access requests are fulfilled within 30 calendar days (one 30-day extension is allowed with written notice), in the format requested if it is readily producible, for no more than a reasonable, cost-based fee.
• Staff verify a caller's identity before discussing PHI and share only the minimum necessary.
• There is a written process for requests to amend a record and for an accounting of disclosures.