Dental practices: what an audit looks like

HHS Office for Civil Rights (HIPAA)

Most cases start with a patient complaint: through October 31, 2024 OCR had received over 374,000 HIPAA complaints and opened over 1,100 compliance reviews. OCR also runs periodic audits of selected Privacy, Security and Breach Notification provisions.

How often. No fixed cycle. OCR audited 166 covered entities and 41 business associates in 2016-2017 and began a 50-entity Security Rule round in 2024-2025.

Source ↗

OSHA or your State Plan agency

Imminent danger comes first, then fatalities and catastrophes, then complaints and referrals, with programmed inspections last. The bloodborne pathogens standard applies to any employee with reasonably anticipated contact with blood or other potentially infectious materials.

How often. No fixed cycle. Priority follows Table 2-1 of OSHA's Field Operations Manual.

Source ↗

State dental board and state radiation control program

Each state licenses dentists and registers dental X-ray equipment under its own rules and sets its own triggers. Check your own state's board and radiation program for what applies to you.

How often. Varies by state. Texas, for example, inspects dental X-ray facilities every four years.

Source ↗

Security risk analysis and risk management records

OCR asks for the current written risk analysis, the one before it, and the policies that govern how it is done. It looks for a defined scope covering every system that holds ePHI, identified threats and vulnerabilities, current security measures, impact and likelihood, and a risk rating.

OCR Audit Protocol, 45 CFR 164.308(a)(1)(ii)(A) and (B)Source ↗

HIPAA policies and Notice of Privacy Practices in force

Requests are for the versions in use on the date of the audit notification, and the auditor will not search compilations for the relevant document. The protocol also asks for the Notice of Privacy Practices and the sanction policy, which may be part of a code of conduct.

OCR Audit Protocol general instructions; 45 CFR 164.308(a)(1)(ii)(C), 164.520 and 164.530(i)Source ↗

HIPAA workforce training documentation

For Privacy and Breach Notification training, the protocol samples documentation from new hires in the audit period and asks for proof that staff were trained on material changes to policies and procedures. For the Security Rule it looks for an awareness and training program that reaches all workforce members, including management.

OCR Audit Protocol, 45 CFR 164.530(b) and 164.308(a)(5)(i)Source ↗

Right of access file

OCR asks for the access policies and procedures, the Notice of Privacy Practices, and the access requests granted and denied with documentation of fulfillment. It samples denied requests and looks for a named person or office that processes requests. The clock is 30 days, with one 30-day extension if the individual is told the reason and the date.

OCR Audit Protocol, 45 CFR 164.524(a) to (d)Source ↗

Written Exposure Control Plan and its records

The plan must be available to OSHA on request. It holds the exposure determination and is reviewed at least annually with documented consideration of safer devices. OSHA can also ask for training records kept 3 years, hepatitis B vaccination and declination forms, and medical records kept for employment plus 30 years.

29 CFR 1910.1030(c), (f)(2), (g)(2) and (h)Source ↗

Hazard communication program, chemical list and safety data sheets

The written program lists the hazardous chemicals known to be present and describes how labels, safety data sheets and training are handled. Safety data sheets must be readily accessible to employees during each work shift, and training is given at initial assignment and when a new chemical hazard is introduced.

29 CFR 1910.1200(e)(1), (g)(8) and (h)(1)Source ↗

Infection prevention program and sterilizer monitoring logs

CDC's checklist asks for site-specific written infection prevention policies, a named coordinator, task-specific training at hire and annually, and written maintenance records for sterilization equipment. Its observation section checks that a spore test is used at least weekly and that a log is kept for each sterilizer cycle.

CDC Infection Prevention Checklist for Dental Settings, Sections I.1, I.2, I.10 and II.6Source ↗

Training files for recent hires

The OCR protocol draws from the population of new hires within the audit period and checks for completed Privacy Rule and Breach Notification Rule training.

Access requests and how they were answered

The protocol asks for requests granted and denied, with documentation of fulfillment, and samples the denied ones. The 2016-2017 audit report noted entities that recorded no dates for the request or response, and responses after 30 days without the written extension.

Sanctions applied to staff

OCR reviews documentation of sanctions applied to a sample of workforce members to see whether they match the practice's own sanction policy.

Staff at work in the operatory and sterilization area

CDC's checklist assesses practice by direct observation of dental health care personnel during their duties, including hand hygiene, protective equipment, sharps handling and instrument reprocessing.

Security risk analysis and risk management

14% of audited covered entities substantially met risk analysis; 94% failed risk management 2016-2017 audits, report published December 2020

OCR found entities generally did not identify the risks to all of their ePHI, and some submitted third-party template policy manuals with no entity-specific review or evidence of implementation. OCR says it will publish findings of the 2024-2025 round when that round is complete.

Source ↗

Written Exposure Control Plan

Ranked 1st of the provisions cited under 29 CFR 1910.1030; no counts published October 2013 to August 2025

OSHA ranks the written Exposure Control Plan first among the bloodborne pathogens provisions most frequently cited, ahead of employee training and hepatitis B vaccination with follow-up. OSHA publishes the ranking without counts.

Source ↗

Versions in force and retention

OCR requests the policy versions in use on the date of the audit notification. Policies must change when the law changes, and policies and required documentation are kept six years from creation or the date last in effect, whichever is later.

Who was trained and when

The protocol looks for training of each new workforce member within a reasonable time and of each member affected by a material policy change, with documentation. OSHA training records name each attendee and job title and the trainer's qualifications, and OSHA training is given at initial assignment and at least annually.

Sanctions and named responsibility

OCR asks for documentation that sanctions were applied to workforce members who failed to follow privacy or security policies. CDC's checklist asks that at least one individual trained in infection prevention be assigned to coordinate the program.

Annual review

OSHA requires the Exposure Control Plan to be reviewed and updated at least annually. CDC's checklist asks that infection prevention policies be reassessed at least annually and says this can happen during that review.