Is my dental practice a HIPAA covered entity?

Almost certainly yes if you file electronic claims, check eligibility electronically, or receive electronic remittances, which nearly every practice does. The ADA states a dental practice becomes a covered entity the moment it submits a claim electronically. Even an all-paper office that sends paper claims to a billing service that converts them to electronic format is reached by HIPAA. Confirm your status, but it's rare for a dental office to be outside HIPAA.

Are dental X-rays and intraoral photos covered by HIPAA?

Yes. Radiographs, intraoral photographs, and CBCT scans are protected health information in any format. Your privacy and security policies must cover imaging stored in your practice-management software, on imaging servers, and anything you send to specialists, labs, or payers as claim attachments.

Do I need BAAs with my dental lab and software vendors?

You need BAAs with vendors that create, receive, maintain, or transmit PHI on your behalf: your practice-management/EHR vendor, cloud backup, billing/clearinghouse, and IT support. A dental lab relationship can be a treatment disclosure rather than a business-associate relationship depending on the facts, so evaluate each partner; when in doubt, paper it correctly.

Does Dentrix or Open Dental being HIPAA-compliant mean my office is compliant?

No. The software is one component. You still need your own Notice of Privacy Practices, written policies and procedures, a documented Security Risk Analysis, breach-notification procedures, and signed BAAs. The product secures data; the compliance documentation is the practice's responsibility.

Made to order · Founding pricing · Built on HHS guidance

The HIPAA forms every dental practice actually needs, in one place

File one dental claim electronically, or run one electronic eligibility check, and your office is almost certainly a HIPAA covered entity. That includes claims you file just so your patient can be reimbursed. HIPAA Binder builds the entire required document set to order: order now at founding pricing and we generate every document from your practice details, delivered within 30 days with a full refund anytime before then. You only enter your practice details, never any patient information.

Or see a sample, or jump to the documents and pricing.

What is inside the binder

A covered dental practice is generally responsible for all of the following. Miss one and it tends to surface at the worst moment: an OCR complaint, a payer audit, or a records request you cannot fulfill.

Notice of Privacy Practices

The notice you must give patients and post in your office and on your website, written for a dental office, not a hospital system.

45 CFR 164.520

Business Associate Agreements

Required with every vendor that can touch patient data: practice-management software, clearinghouse, cloud backup, IT support. Labs and specialists need a case-by-case call, and your binder maps each one.

45 CFR 164.502(e)

Security Risk Analysis

The most-cited deficiency in OCR enforcement. In a dental office it must reach your imaging: X-rays, intraoral photos, and CBCT scans are PHI in any format.

45 CFR 164.308(a)(1)(ii)(A)

Privacy & Security Policies

Your written rulebook for access, minimum-necessary use, and sanctions, including reasonable safeguards for treatment-plan and financing conversations at an open front desk.

Privacy & Security Rules

Patient-rights & authorization forms

Access, amendment, accounting of disclosures, and release forms, covering the records and imaging you exchange with specialists, labs, and payers.

45 CFR 164.508

Breach procedure & Privacy Officer docs

A breach-notification procedure and log, plus the Privacy/Security Officer designation. In a small office, that is you, and you need it on paper.

Breach Notification Rule

Why not just use the free HHS templates?

You can, and we cite them. But the free model documents are written for hospitals and every covered entity at once. They do not speak to a dental office that lives in practice-management software, sends imaging to specialists and payers as claim attachments, and answers to OSHA as well as HIPAA. You are not paying us for a file you could find. You are paying for it customized to a dental practice, complete, and kept current.

Am I even a covered entity?

Almost certainly, yes. Under 45 CFR 160.103, one electronic claim, eligibility check, or remittance makes you a covered entity, and that includes filing a claim electronically so your patient can be reimbursed. Even an all-paper office is reached when its billing service converts claims to electronic form.

See the full covered-entity breakdown for dentists

Or read the guide: Do I need HIPAA forms for my dental office?

HIPAA is not a dental office's only paperwork. OSHA's general-industry standards also apply to dental practices: bloodborne pathogens, hazard communication, PPE, and training documentation. The HIPAA + OSHA Binder Bundle covers both in one order. $299 $328 separately.

The binder is hand-prepared and customized to your dentistpractice, with the same documents, organized to your specialty’s records and vendors.

Made to order · Founding pricing: first 25 practices

Lock in founding pricing

Every document is made to order at locked-in founding pricing, built from your practice details and delivered within 30 days, with a full refund anytime before then. Each binder is built by hand, so founding pricing is limited to the first 25 practices; after that the Complete Binder is $249. Preview any document free before you decide.

Single document

$49one-time

Founding price · $79 after the first 25 practices

Just the one document you need, built for your practice.

Choose your document

Notice of Privacy PracticesBusiness Associate AgreementSecurity Risk Assessment

Instant: answer a short wizard, watch your document fill in live, and unlock the files for the same $49.

Built for your practice: profession, state, and billing setup shape every clause
Every policy cites the regulation that requires it
Editable Word + annotated PDF
See your finished notice before you pay
Instant download after checkout

Generate your NPP

The Complete Binder

Most complete

$129one-time

Founding price · $249 after the first 25 practices

Every HIPAA document a private practice needs, in one place.

Notice of Privacy Practices (current rules)
Covered-entity determination for your billing setup
BAA template + filled vendor table for your actual stack
Security Risk Analysis workbook + full policy set
Breach procedure: federal + your state's statute
Print-ready patient forms, annotated PDF, editable Word
Free revisions for 30 days after delivery

Order The Complete Binder

Binder + Always-Current

Stays current

$129+ $99/yr after 30 days

Founding price · $249 after the first 25 practices

The full binder, plus an annual refresh that keeps it current.

Everything in the Complete Binder
When a cited rule changes, we update the affected documents and send them to you
Every update comes with a note: what changed, why, and the citation
Annual refresh: every citation in your binder re-verified
Annual risk-assessment and training reminders
BAA tracker for your vendors
First year of updates starts 30 days after your order
Cancel anytime, the binder is yours

Order Binder + Always-Current

Opening a dental office? HIPAA + OSHA Binder Bundle: $299 $328 separately

Add the OSHA binder: exposure control plan, hazard communication, sharps and training documentation, every policy citing the regulation that requires it.

Founding price · $449 after the first 25 practices

Order both binders

Your documents are built to order and delivered within 30 days, with a full refund anytime before delivery. The subscription then keeps every document current as HIPAA rules change and reminds you when your annual risk assessment is due. Cancel anytime.

Questions dentists ask

See exactly what you are missing, free

Enter your email and we will send a preview of the dentist binder, so you can judge the quality before you pay a cent.