HIPAA Compliance for Dental Offices: A Dentist Guide

It was just a few years ago when news broke that a dental practice had to pay a $10,000 fine to the Office of Civil Rights (OCR) for a HIPAA violation.

The practice in question disclosed protected health information (PHI) in response to a bad Yelp review that one of its patients left.

Although on the more extreme end, that’s a clear violation of the HIPAA Privacy Rule. Otherwise known as the Health Insurance Portability and Accountability Act Privacy Rule. Social media isn’t a great place to share and discuss patient information. What that practice did on Yelp is just one example of many.

Sharing PHI on a public forum is just one forbidden action of hundreds within the Privacy Rule. On top of that, the Privacy Rule is just one-half of the whole regulation. There’s also the Security Rule...which is the more complicated of the two main parts of HIPAA.

There are so many requirements to HIPAA that many dental practices end up confused.

Any compliance “expert” would tell you that the breach is the result of a poor training program.

What they usually won’t tell you is what you should include in your training program. Also, how often you need to send it to your team.

That’s why I’m going to give you everything you need to know about HIPAA training for dental offices. Everything from requirements to content.

HIPAA Requirements for Dental Offices

If you search anything about HIPAA on Google, you’re going to get a lot of high-level information.

For example, I Googled the phrase “HIPAA” and the first result was from the CDC.

It’s a great webpage that gives a nice general overview of HIPAA, its nomenclature and its requirements. I’m not here to critique this webpage.

However, I want to bring attention to the verbiage used within the “Covered Entities” part of this page.

The first sentence states that the types of organizations listed within that section need to adhere to the HIPAA Privacy Rule. The very first individual listed as a covered entity is “healthcare providers.”

It goes on to describe that every healthcare provider needs to follow the requirements listed within the HIPAA Privacy Rule. As long as that individual or organization transmits health information electronically.

From that, you’re likely to think up two big questions.

First, who’s a healthcare provider and do dentists fall under that umbrella term?

Federal law defines dentists as healthcare providers. I imagine you already knew that, though.

How HIPAA Applies to Dental Offices

What kind of electronic information transmission is that section referring to?

The main forms of electronic information transmission that occur in dentistry are…

• Claims
• Eligibility requests
• Claim status inquiries
• Treatment authorization requests

‍

It’s unlikely that your practice relies entirely on paper. Not only would you face payment adjustments from Medicare starting way back in 2015, but you’d also lose patients. Specifically, to other more modern practices based on what certain generations prefer.

The ADA strongly recommends that all dental providers install HIPAA’s required safeguards.

It wasn’t easy to get to the bottom of HIPAA’s requirements for dentists. Long story short, all dentist practices should pursue compliance.

HIPAA Compliance for Dental Offices

We know that every dental organization should pursue and maintain HIPAA compliance. The next question is, “Are there any differences in HIPAA for dental providers?”

The answer to this question doesn’t need as much investigation, thankfully.

HIPAA defines organizations who need to follow its rule as covered entities. This makes classification easier.

If a dental organization meets the criteria of a HIPAA covered entity, it needs to adhere to every rule.

There aren’t any differences between HIPAA for dental offices or other practitioners. It also isn’t different for a business associate, or organizations who work with dentists.

A dentist that works with a business associate should know when a business associate agreement is necessary. As well as what responsibilities each organization has.

What Dental HIPAA Training Should Include

Whether you’re creating your own HIPAA training or sourcing one, keep in mind the type of content.

Will your team learn if their training goes over general examples about patient privacy? Sure.

However, don’t you think it would be more effective if your HIPAA training contained actual, real-world scenarios that occurred in the dentistry space?

I think it’s safe to assume that the second option is what you and most other dental organizations would want.

An excerpt from the book Mind, Brain, and Education: Neuroscience Implications for the Classroom, states, “Often, the learner’s emotional reaction to the outcome of his efforts … shapes his future behaviour.”

In other words, if a student doesn’t find that their lesson is relevant, there’s a high chance that the material isn’t going to sink in.

Although from a classroom perspective, that same mentality carries over to the business world, arguably more so. You see, given the current burnout situation within the healthcare industry, your team most likely doesn’t have much time for anything else other than patient care.

Thus, if the HIPAA training program you send to your team doesn’t contain relevant examples...the material isn’t going to land.

That’s why you need to include relevant examples and scenarios throughout.

For a dental office, those examples should show employees how to handle patient information, patient records, and other protected health information during everyday dental care.

Your dental office staff should understand how the HIPAA Privacy Rule applies to the information they handle and how their actions can affect patient privacy.

Training should also help employees understand the steps they need to take to comply with HIPAA when handling patient information, including what to do if they suspect a privacy or security issue.

When Should Dental Practices Provide HIPAA Training?

Alright, we’ve figured out that…

• You should train your dental employees on HIPAA
• The law’s requirements don’t change among industries
• Relevant examples help with getting the material to stick

Even after all of that, though, you probably still have at least one more major question, “When should I train my employees?”

That’s another question that deserves some investigation because the law isn’t as helpful in this regard.

Don’t get me wrong, training is an…

• Administrative requirement within the HIPAA Privacy Rule (45 CFR §164.530)
• Administrative safeguard within the HIPAA Security Rule (45 CFR §164.308)

Yet, if you look at what’s stated within those two sections...the training requirements are what you could call “flexible”.

You see, the Privacy Rule requires that each new member of your workforce receives training “within a reasonable period of time after the person joins”.

The Security Rule adds to the Privacy Rule’s training requirement by stating that it should happen on a “periodic” basis.

In other words, the Privacy Rule says it should happen at some point when a new employee comes on board. The Security Rule mandates that ongoing training should also happen. They’re both super vague and open to interpretation.

Maybe the ADA can provide some guidance on the matter.

Unfortunately, the ADA’s webpage about HIPAA training for dentists just reiterates what the law requires. That’s not that much of a surprise, the ADA isn’t the organization that enforces HIPAA.

But, if the requirements on training remain ambiguous, what’s the best thing to do?

First, have your employees take your HIPAA training on their first day. It’s unlikely that they'll have to deal with any PHI on their first day, take advantage of that by teaching them how to handle it properly.

Second, enforce that your entire workforce retakes your training program on an annual basis.

Those two easy policy implementations are not only best practices, but they also satisfy what’s mandated.

For dental office employees, this training should cover the basics of HIPAA privacy and security. It should also explain how to handle patient health information and patient records.

Keep Your Dental HIPAA Compliance Training Up to Date

Let’s say that after reading this blog post you go out and find a HIPAA training program that’s made for dentists. Awesome.

However, this training program won’t do you any good if it’s outdated.

You see, the Department of Health and Human Services (HHS) doesn’t believe being 100% compliant with HIPAA is attainable. Instead, it believes that compliance with the law is ongoing and ever changing.

In other words, the training that you enforce upon your employees needs to stay up-to-date and change with new amendments to it.

The ADA also reflects this philosophy in the same paragraph I provided in a previous section.

But, what kind of “updates” should your training include and how do you find them?

I’ll give you an example.

In March of 2021, the HHS proposed roughly 15 changes to the HIPAA Privacy Rule. Most of the changes to make certain parts of the law more flexible in order to account for COVID-19 and the opioid pandemic.

A few months later, in May 2021, the ADA made comments on some of the proposed changes stating that they may overburden dental offices.

Including what those proposed changes are and the ADA’s criticisms of them are two imperative topics to include in your HIPAA training program.

Staying current with HIPAA regulations is an important part of ongoing compliance. As HIPAA laws and guidance change, dental practices need to review their compliance efforts and update training when needed.

This includes keeping employees familiar with requirements such as the Notice of Privacy Practices and the Breach Notification Rule.

The Breach Notification Rule addresses what covered entities and business associates must do after certain breaches of unsecured protected health information. Dental practices should make sure their training covers the appropriate response process.

Conclusion

I imagine when you clicked the link to this blog post you didn’t realize how involved and meticulous the HIPAA training requirements are for dentists.

Hopefully, by the end of it, you have a better idea as to what’s required of you and how to implement a HIPAA training program that’s effective for your dental organization.

Out of everything, though, the biggest takeaway is that the requirements don’t change across healthcare specialties. Regardless of whether you’re a general practitioner or a specialty dentist, your HIPAA training mandates as a covered entity don’t change.

For a dental practice, the goal is simple: understand the HIPAA requirements that apply to your organization, train your employees, and keep your compliance efforts current.

The Office for Civil Rights (OCR) is responsible for enforcing and administering certain HIPAA privacy and security requirements. Understanding the role of the Office for Civil Rights can help dental practices recognize why these requirements matter.

That means knowing how to protect patient information, follow the HIPAA Privacy Rule and HIPAA Security Rule, and maintain appropriate privacy and security safeguards.

When dental practices take these steps, they can better protect patient data and support the trust patients place in their dental care providers.