Your hygienists handle PHI between every patient. Do they know the rules?
Charts on the operatory screen, X-rays sent to the lab, insurance forms at the front desk, appointment texts going out all afternoon. That's a lot of protected health information moving through your office every hour. EZBunny covers the HIPAA scenarios your dental team actually faces.
Train my dental teamHIPAA is the federal law that protects patient health information. Annual training is the industry standard.
Breaches affecting 500+ individuals are published on the HHS Breach Portal (the "Wall of Shame"), a permanent, public record. Training your team is the most effective way to avoid it.
And it gets stricter. States like California (CMIA) and Texas (HB 300) impose penalties beyond federal HIPAA. Your team needs to meet the highest standard.
25+ courses your dental team actually needs
Beyond HIPAA, your team needs OSHA safety training, fraud prevention, cybersecurity awareness, and state-specific compliance. EZBunny covers it all in one subscription.
Browse All Courses →What keeps dental offices up at night
$125,000 fine for unencrypted X-rays
A dental practice emailed patient X-rays and insurance details to a lab without encryption. HHS fined them $125,000.
30 minutes, done between patients
Audio-narrated lessons with quick knowledge checks. Your hygienists and front desk staff finish during a lunch break. No full-day seminar needed.
Front desk touches PHI all day long
Insurance verifications, EOBs, intake forms, phone calls with patient details. Your treatment coordinator handles more PHI than anyone in the practice.
See who's trained before the auditor asks
One dashboard shows every team member's status. Who finished, who's overdue, who just started. Export a report for your state dental board in two clicks.
Shared operatory computers, shared risk
Two hygienists and a dentist sharing one workstation. No individual logins, no auto-lock, and the patient in Chair 3 can see Chair 2's chart on the screen.
New hygienist? Already reminded
EZBunny sends training reminders automatically. When you hire someone, they get an invite. When a certificate's about to expire, they get a nudge. You don't chase anyone.
Texting patients from personal phones
Patients want text reminders. Your assistant texts back from their own phone. One appointment confirmation with treatment details is a potential breach.
Certificates that hold up to scrutiny
Each certificate has a unique ID and public verification link. When a dental board or insurance auditor asks for proof, you've got it.
One flat price. Every hygienist, assistant, and front desk person included
No per-seat charges. No hidden fees. Cancel anytime.
Beyond HIPAA: All the Training Dental Offices Need
HIPAA is just the start. Here's what dental teams also need.
OSHA Safety (Required)
Dental offices have high bloodborne pathogen exposure from procedures. Required courses: Bloodborne Pathogens, OSHA General Safety, Hazard Communication, and Infection Control. State dental boards and OSHA both enforce these.
Mandatory Reporting (Required)
Dentists are mandatory reporters in all 50 states. Your clinical team must know how to identify and report suspected child abuse and neglect. Failure to report is a criminal offense in most states.
Workplace Safety
Sexual harassment prevention is federally required under Title VII. Many states add annual requirements. Protecting your team and your practice starts with documented training.
Cybersecurity Awareness
Dental practices are frequent ransomware targets. Phishing emails targeting practice management systems are common. Cybersecurity and phishing awareness training protects your patient data and your business.
Documentation & Records
State dental board requirements and billing accuracy depend on proper records practices. Documentation and Medical Records Compliance keeps your charts audit-ready.
Business Associate Compliance
Your lab, imaging vendor, and billing company are Business Associates under HIPAA. Your staff needs to understand BA relationships, BAAs, and their own obligations when sharing patient data with vendors.
Training by Role
Different roles need different courses. Here's a breakdown for dental teams.
| Role | Core Courses | Additional |
|---|---|---|
| Dentist | HIPAA Privacy & Security, Bloodborne Pathogens, Infection Control, Mandatory Reporting, OSHA General Safety, HazCom, Sexual Harassment Prevention | Medical Records; FWA if billing Medicaid |
| Dental Hygienist | HIPAA Privacy & Security, Bloodborne Pathogens, Infection Control, OSHA General Safety, HazCom, Sexual Harassment Prevention, TB Prevention | |
| Dental Assistant | HIPAA Privacy & Security, Bloodborne Pathogens, Infection Control, OSHA General Safety, HazCom, Sexual Harassment Prevention | |
| Front Desk / Receptionist | HIPAA Privacy & Security, Sexual Harassment Prevention, Business Associate Awareness | Phishing & Risk Analysis |
| Office Manager | HIPAA Privacy & Security, Medical Records, Sexual Harassment Prevention | FWA if billing Medicaid; Cybersecurity |
| Sterilization Technician | Bloodborne Pathogens, Infection Control, OSHA General Safety, HazCom, Sexual Harassment Prevention | |
| Billing Coordinator | HIPAA Privacy & Security, CMS FWA, Medical Records, Sexual Harassment Prevention |
State-Specific Requirements
State-specific content currently covers CA, TX, FL, NY, and IL. Additional states may have requirements not listed here.
- If you operate in California: CMIA privacy training (required); cultural competency CE for licensed dentists; workplace violence prevention (SB 553)
- If you operate in Texas: HB 300 privacy training within 90 days of hire - Texas imposes penalties up to $1.5M per incident, stricter than federal HIPAA
- If you operate in Florida: HIV/AIDS training for applicable licensed practitioners per FL Statute 381.0034
- If you operate in New York: Infection control every 4 years for dentists and dental hygienists (PHL Section 239); sexual harassment prevention annually
Proposed changes to the HIPAA Security Rule (expected 2026) may expand cybersecurity requirements for dental practices. Browse all 25+ courses →
Common HIPAA questions from dental practices
What are the HIPAA rules for storing dental X-rays and imaging?
All dental imaging (X-rays, panoramics, and CBCT scans) is PHI and must be encrypted with role-based access. If your practice uses digital imaging software, the vendor must sign a Business Associate Agreement (BAA). Physical X-ray films must be stored in locked areas with access limited to authorized staff.
Does front desk staff at a dental office need HIPAA training?
Yes. Every front desk employee who touches PHI must complete HIPAA training. Front desk staff, treatment coordinators, and office managers handle PHI constantly: scheduling, insurance verification, patient intake forms, and phone conversations. Training must include understanding the minimum necessary standard and proper disposal of paper records.
Can dental offices text patients appointment reminders?
Basic appointment reminders are generally permissible, but texts must never include clinical details. The message must not include treatment type or diagnosis. Many practices use HIPAA-compliant patient communication platforms. If you use a third-party texting service, they must sign a BAA. Staff should never text clinical information from personal phones.
How should dental offices handle HIPAA compliance for insurance billing?
All billing software must encrypt electronic claims, and staff should only access what they need. Dental billing involves transmitting PHI including patient demographics, diagnosis codes, and treatment details. Paper claims or EOBs must be stored securely and shredded when no longer needed. Third-party billing companies must have a signed BAA.
What HIPAA risks do shared operatory computers create?
Shared operatory computers are one of the most common HIPAA risks in dental offices. Each user should have unique login credentials, with no shared passwords. Enable automatic screen lock after 2-3 minutes of inactivity. Position monitors so patients in adjacent chairs cannot see another patient's records. Log out between patients, not just between shifts.
Who can access patient records in a dental practice?
Each staff member should only access the PHI they need for their specific role. This is HIPAA's minimum necessary standard. Dentists and hygienists need full clinical records. Front desk needs scheduling and contact info. Billing staff need procedure codes and insurance details. Configure your practice management software with role-based access to enforce these boundaries.
Get your whole office covered
Set up takes about 5 minutes. Try it free for 14 days.
Get started freeRegulatory Disclaimer
Training requirements vary by organization type, size, state, payer mix, and accreditation. This guide reflects common federal and state requirements as of April 2026 and is not legal advice. Consult your compliance officer or legal counsel for requirements specific to your organization. State-specific content currently covers CA, TX, FL, NY, and IL. Additional states may have requirements not listed here. Last reviewed: April 2026.