OSHA and HIPAA Compliance Basics for Dental Offices

Compliance work rarely feels urgent until an inspector calls, a needlestick happens or a laptop goes missing. Then everyone wants to know where the exposure control plan is and when the last risk analysis was done. This guide covers the core OSHA and HIPAA requirements for a dental office, what to document, and a simple calendar to keep it current. It’s a starting point, not a substitute for a compliance program tailored to your practice.

Who enforces what in Virginia

• Workplace safety: Virginia operates an OSHA-approved State Plan, Virginia Occupational Safety and Health (VOSH), run by the Department of Labor and Industry. VOSH generally adopts federal OSHA standards and can add its own.
• Patient privacy and security: HIPAA is federal and enforced by the HHS Office for Civil Rights (OCR).
• Infection control and licensure: the Virginia Board of Dentistry sets professional standards, including for the duties assistants and hygienists may perform.

OSHA: bloodborne pathogens

The bloodborne pathogens standard (29 CFR 1910.1030) is the OSHA rule that matters most in dentistry. The essentials:

• Written exposure control plan, identifying which jobs have exposure, the controls in place and the post-exposure procedure. Review and update it at least annually.
• Safer sharps. Each annual review must document that you considered commercially available safer devices, with input from non-managerial staff who do patient care.
• Engineering and work-practice controls, such as sharps containers, no recapping by hand unless using a one-handed technique or device, and handwashing.
• PPE provided at no cost: gloves, masks, eye protection, gowns.
• Hepatitis B vaccination offered at no cost within 10 working days of initial assignment, with a signed declination if refused.
• Post-exposure evaluation and follow-up at no cost to the employee.
• Training at initial assignment and at least annually, during working hours, with records kept three years.
• Medical records for exposed employees kept for the duration of employment plus 30 years.

OSHA: the other standards that apply

OSHA’s dentistry page summarizes which standards commonly apply.

The 2024 hazard communication update

OSHA revised the hazard communication standard in 2024 to align with a newer version of the global labeling system. After an extension, employers have until November 20, 2026 to update workplace labels, the written program and employee training for newly identified hazards of chemical substances. In a dental office, that mostly means checking that your safety data sheets are the current versions from suppliers, that secondary containers (such as spray bottles of diluted disinfectant) are labeled, and that training covers the updated labels and data sheets.

Injury records and reporting

Offices of dentists (NAICS 6212) are on OSHA’s list of partially exempt industries, so most dental offices don’t have to keep the routine OSHA 300 injury log unless asked to. But every employer must still report a work-related fatality within 8 hours and an in-patient hospitalization, amputation or loss of an eye within 24 hours, and the current VOSH poster sets the same deadlines for reports to VOSH. Keep an internal record of sharps injuries and exposures regardless; the bloodborne pathogens standard requires a sharps injury log for employers who keep the OSHA 300 log, and many dental offices keep one anyway as good practice.

Penalties: what non-compliance can cost

Sources: OSHA penalties page and the VOSH Job Safety and Health poster. Actual penalties are usually lower than the maximums and are often reduced for small employers and good faith, but a handful of citations can still exceed what a compliance program would have cost. HIPAA civil penalties are separate, tiered by how culpable the practice was, and adjusted for inflation each year.

Infection control, X-rays and amalgam

Infection control

OSHA protects workers; infection control also protects patients. The CDC Summary of Infection Prevention Practices in Dental Settings is the standard reference, and it includes a checklist you can use for a self-audit of hand hygiene, sterilization and instrument processing, waterline maintenance, and environmental cleaning. The Virginia Board of Dentistry requires dentists to maintain a safe and sanitary practice (18VAC60-21-60), so infection control lapses can become a licensing matter as well as a safety one. Keep sterilizer spore-test results and maintenance logs with the compliance binder.

X-ray registration and inspection

In Virginia, dental X-ray machines must be registered with the Virginia Department of Health’s Office of Radiological Health and are inspected every three years by a private inspector. Keep the registration and the latest inspection report on file, and update the registration when you add, replace or remove a unit. Assistants who take X-rays need the radiation certification described in our onboarding guide.

Amalgam separators

The EPA’s dental effluent guidelines (40 CFR Part 441) require dental offices that place or remove amalgam and discharge to a public sewer to operate and maintain an amalgam separator, follow best management practices such as not rinsing scrap amalgam down the drain, and file a one-time compliance report with their local wastewater authority. Keep separator inspection and maintenance records. If you’re opening or buying a practice, confirm the report was filed; see our due diligence checklist.

HIPAA: the three rules

Privacy Rule

• A Notice of Privacy Practices, given to patients and posted in the office and on your website.
• Policies on uses and disclosures, minimum necessary access and patient rights.
• A process for patient record requests, generally answered within 30 days.
• A designated privacy officer.

Security Rule

• A documented risk analysis of where electronic patient information lives and what could go wrong, updated when systems change. OCR enforcement often finds this missing.
• A risk management plan to address what the analysis finds.
• Access controls, unique logins, automatic logoff, audit logs and backups.
• Security awareness training for the workforce.
• A designated security officer.

Breach Notification Rule

If unsecured patient information is breached, affected individuals must be notified without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more people must also be reported to HHS within 60 days, and to prominent media if 500 or more residents of a state are affected. Smaller breaches are logged and reported to HHS within 60 days after the end of the calendar year.

Business associates

Any outside company that handles patient information for you, such as your practice management software vendor, IT provider, cloud backup, clearinghouse, billing service or patient communication platform, needs a signed business associate agreement. Keep a list of vendors and their agreements. Our guide to choosing practice management software covers questions to ask vendors.

When a vendor relationship ends, make sure patient data is returned or destroyed as the agreement requires, and that the vendor’s logins and remote access are shut off. Former IT providers with lingering remote access are a common, avoidable risk.

The pending HIPAA Security Rule update

In January 2025, HHS proposed the first major update to the Security Rule in years. It would make several safeguards explicit requirements, including multi-factor authentication, encryption, an asset inventory and network map, and annual compliance audits. As of October 2026 it has not been finalized, and federal regulatory planning has pointed to 2027 at the earliest. The current rule remains enforceable. Many of the proposed safeguards are good practice anyway, so it makes sense to start on them now. See the HHS fact sheet.

Check your Notice of Privacy Practices

HIPAA rule changes finalized in 2024 required covered entities to update their Notice of Privacy Practices by February 16, 2026. A 2025 court decision vacated most of the reproductive health privacy rule, but HHS has said the notice changes, including language tied to substance use disorder records, still apply. If your notice hasn’t been revised since 2025, compare it with the current requirements on the HHS reproductive health privacy page.

Lessons from dental enforcement cases

• OCR has settled multiple cases with dental practices for failing to give patients timely access to their records. In October 2026 it announced a $140,000 settlement with Shen Smiles, a Pennsylvania dental practice, over a former patient’s records requests and missing privacy policies, and in 2024 it imposed a $70,000 penalty on Gums Dental Care for the same kind of failure.
• Vendors can expose your patients too: OCR’s 2026 settlement with a dental software company is covered in our software guide.
• Dental practices have paid settlements or penalties for disclosing patient information while responding to online reviews; see getting patient reviews the compliant way.
• Missing or outdated risk analyses show up repeatedly in OCR resolution agreements across health care.

Daily, weekly and monthly tasks

Adjust these to your equipment instructions and written protocols; the point is that someone owns each task and it’s logged.

If an OSHA or VOSH inspector arrives

1. Greet the inspector, ask for credentials and the reason for the visit (a complaint, a referral or a programmed inspection), and call the compliance lead and the owner.
2. It’s reasonable to ask for a short delay to have the right person present, and to ask that patient areas be handled in a way that protects privacy.
3. Go to the scope of the inspection. If it’s a complaint, the inspector will usually focus on that issue.
4. Have the compliance binder ready: exposure control plan, training records, hazard communication program, PPE assessment and injury records.
5. Take notes and photos of what the inspector reviews, and fix simple problems on the spot where you can.
6. If citations follow, you have a short, fixed window to request an informal conference or contest them. Note the deadline on the citation the day it arrives and talk to counsel.

An annual compliance calendar

Keep a compliance binder

Whether it’s paper or a shared folder, keep every compliance document in one place so you can produce it quickly if an inspector, auditor or attorney asks:

• Exposure control plan and annual review notes, including the safer-device review.
• Training sign-in sheets and materials for OSHA and HIPAA, by date.
• Hepatitis B vaccination records and signed declinations (kept confidential, separate from personnel files).
• Chemical inventory and safety data sheets.
• HIPAA policies, Notice of Privacy Practices, risk analysis and risk management plan.
• Business associate agreements and vendor list.
• Breach and incident log, and records request log.

Name one person as compliance lead, with time on the schedule to keep the binder current.

Small offices sometimes assume compliance rules are only for large practices. The core OSHA and HIPAA requirements above apply regardless of size, so a two-chair office needs the same written plans, training and records as a ten-chair one, just with less to document.

Getting help

Cisor’s practice management and systems development teams help practices organize compliance documents, set up the calendar and training records, and tighten software and device security. For a formal legal opinion or a full security assessment, involve your attorney and a qualified security firm. Call (703) 345-0606 to talk about where to start.