Dental HIPAA Violations That Put Your Practice at Risk

However, how will you know whether malpractice is a reason behind dental HIPAA violations? A HIPAA violation is an improper use, disclosure, or failure to protect a patient’s identifiable health information contrary to HIPAA rules made by the dental practice.  

You may not have enough funds to employ a dedicated HIPAA compliance expert. But you can minimize compliance risk by establishing policies, training, vendor agreements, and security controls. A full-time compliance officer is not necessary to implement all of these “best practices” and patient protection measures. 

This guide includes real-world examples of dental HIPAA violations, potential HIPAA fines, and common HIPAA mistakes that can expose patient information.

Unauthorized Disclosure of Patient Information on Social Media and Online Reviews

Answering online reviews or posting smile photos before and after your treatment can lead to a violation of HIPAA if you reveal identifiable patient information without authorization. Here are a few examples of dental HIPAA violations. 

Responding to negative reviews with patient details

Protected health information (PHI) includes details that can directly or indirectly identify a patient. These details may include names, photos, treatment information, or unusual medical circumstances.

Confirming that someone is your patient can violate HIPAA. It reveals their relationship with your practice without authorization.

In 2015, a North Carolina practice responded to a one-star Google review with the patient’s name and treatment details. The patient filed a complaint with the Office for Civil Rights (OCR), which enforces HIPAA privacy rules. The practice ignored OCR’s request and was issued a $50,000 civil penalty in 2022. 

Never confirm that a reviewer has a patient or talk about a patient publicly.

Prevent marketing and front-desk employees from taking action in response to patient feedback. Identify robust rules of escalation. Use a blanket statement like, “We appreciate your feedback – please give us a call about your concerns in our office”.

Posting before-and-after photos without written authorization 

Patient photos cannot be used for marketing purposes on a consent-to-treat form. To post before-and-after treatment pictures of your patients, you must have an independent signed HIPAA authorization.

The authorization form should include instructions for use of the photographs, the intended recipients, and the expiration date. This document also describes how patients can withdraw consent and any exceptions in the case of withdrawal and whether treatment will proceed without consent. 

Keep a record of signed photo authorizations, authorized uses, and expiration dates. If a patient denies consent, as soon as possible review the content and remove it if necessary, even if it’s content you control as a marketing tool, such as on social media.

Review how state privacy laws can be stricter than federal HIPAA to determine whether additional consent or disclosure requirements apply in your state. It should be a common practice, especially before uploading a patient’s photo.  

Identifying a patient indirectly without using their name 

HIPAA does not automatically de-identify information if a patient’s name is removed. Additional information like treatment dates, geographic, and personal information can identify a patient when combined.

People in the community can identify the patient by a caption like: “Smile makeover completed Tuesday, March 14th for teacher from Cedar Falls.”

If a dental practice is going to treat patient information as de-identified, it is required to remove identifying information under HIPAA’s Safe Harbor method. These details include full dates (except for the year) and most location details smaller than a state.

To avoid identifying information in your marketing content, use a general caption, which should avoid identifying details, such as:

“We loved helping this patient achieve their brand-new smile!”

Get the appropriate HIPAA authorization before showing patient pictures or treatment history. 

Generally, photos of the patient’s face, before and after smiles, do not qualify as de-identified just because the patient’s name is removed; after all, the photos are part of Safe Harbor’s 18 identifiers. 

What OCR enforcement looks like for social media violations

During an OCR investigation, your practice may need to provide privacy policies, training records, security risk assessments, and evidence of corrective actions. 

The practice could also be subject to financial penalties or corrective action plans, depending on the results.

There might be a need for policy changes, employee training, and continued compliance objectives. OCR can also audit the practice for 2 years to ensure it is compliant with HIPAA regulations. 

Sometimes well-intentioned staff responses can trigger regulatory scrutiny. Protecting your practice’s reputation does not justify disclosing patient information. Dental offices should not confirm a patient’s identity or discuss treatment using the Internet. 

Instead, they should answer professionally, without giving away any information about the patient, and redirect the conversation to private communication.

Missing or Expired Business Associate Agreements With Dental Vendors

Your dental practice may face compliance risks without a Business Associate Agreement (BAA). A vendor-related data breach could expose patient information and leave your practice without essential contractual protections.

Which vendors actually need a signed BAA

Ensure that every vendor handling your practice’s protected health information (PHI) has a signed BAA. These vendors may include:.

• Cloud storage and backup companies that store patient records.
• Dental practice management software companies that have access to patient information.
• IT support companies that can view or manage patient records.
• Billing/claims processing services that deal with patient/insurance data.
• Patient communication and appointment reminder software that utilizes patient information.

A required BAA can’t be substituted by a vendor’s security certification. Sign and save your agreement with your vendor, and review it whenever it’s renewed. 

If your practice is in California, you must review California’s medical confidentiality requirements for outside vendors to ensure agreements comply with California privacy policies and HIPAA.

What happens when a vendor becomes the breach point

A vendor-related breach can expose patient records. It may also trigger HIPAA breach notification requirements, regulatory penalties, and a loss of patient trust. Ransomware that impacted software behind DDS Safe reportedly forced 400 practices off charts, X-rays, and payment records in August 2019.

Your practice may still face HIPAA compliance issues if a required BAA is missing, even when the vendor causes the breach.

Improper Disposal of Patient Records and Equipment

Patient information can remain in old paperwork, discarded computers, and office equipment. HIPAA requires dental practices to protect patient information during disposal. 

Paper records and the shredding requirement

Destroy patient records in a way that they cannot be read or reconstructed. Shredding, pulping, burning, or pulverizing the paper is acceptable.

The HIPAA Privacy Rule (45 CFR § 164.530(c)) requires covered entities to use appropriate safeguards to prevent unauthorized use or disclosure of protected health information (PHI). 

The HIPAA Security Rule (45 CFR § 164.310(d)(2)(i)–(ii)) also requires procedures for disposing of electronic protected health information (ePHI) and removing it from electronic media before reuse.

If you throw a misprinted form with a patient’s name and birth date in a regular trash can, it can expose PHI. 

North Dental in Fairhope agreed to pay $62,500 to settle potential HIPAA violations after it shared health information with a political campaign manager and third-party marketing company in 2022. 

The practice was also required to implement a two-year corrective action plan. Store records that are to be destroyed in a safe place, use a reputable shredding or disposal company, and record the date and method for destruction.

Decommissioning old computers, X-ray sensors, and backup drives

Removing files from old computers, X-ray sensors, or backup drives may not eliminate patient information.

Before replacing equipment or changing software, use verified data-erasure tools. These tools help make patient information unrecoverable. Simply deleting files or resetting a device may not be enough.

Office copiers and printers may store PHI, including patient names, treatment plans, and billing records on internal hard drives. Before selling, returning, or disposing of these devices, securely erase or destroy stored data. 

For leased equipment, confirm that the vendor removes all PHI before the device leaves your control. 

 If you’re changing software vendors, make sure that the former vendor has completely removed patient data from their system. Maintain a disposal log for destroyed records and equipment. Include the destruction date, method, and responsible person. Attach a destruction certificate when available.

Unsecured Texting, Email, and Imaging of Patient Information

Dentists may find it convenient to send X-rays to personal phones or treatment details through regular email. However, these practices can expose patient information.

Why standard SMS and personal email don’t qualify

Regular text messages and personal emails can expose patient information. They may lack adequate encryption, store unprotected data on devices, or provide limited visibility into who accesses messages.

Consumer services can also be subject to not having a signed BAA if the provider meets the definition of a business associate.

These gaps may complicate your practice’s ability to comply with HIPAA security standards.

Use a practice-approved messaging system to protect patient information. Restrict access to authorized users and secure all messages and images. Staff members confirm receipt before they are sent out and report any misdirected messages without delay, and then the practice can determine if a breach has occurred

Sending radiographs and treatment photos between staff

X-rays and treatment images are frequently sent to dental staff to help with patient care. Avoid sending photos via private messaging apps; use secure, practice-proven apps. 

Require staff to use approved devices and secure, practice-managed storage. Lost or stolen phones can expose patient images. Automatic backups to personal cloud accounts can also compromise privacy.

Turn off authorized sync, turn on device encryption, use a strong passcode, and enable remote wipe. 

Appointment reminders and billing messages 

A dental practice may assume appointment reminders are harmless because they are intended to communicate scheduling information rather than clinical details. An appointment reminder can reveal more information than intended when it links a patient’s name to a specific procedure, provider, or treatment location. 

Review reminder templates for content to make sure that they contain only the essential information for reminders and confirmation.

A message such as “Maria, your root canal with Dr. John is Friday at 2 p.m.” connects a named person to a particular treatment, providing private health details.

Keep your reminders brief and share only necessary information: “You have an appointment Friday at 2. Reply C to confirm.’’ 

Billing messages need the same care. Without proper protection, the email sent by front-desk staff might end up in the wrong hands or may be hacked, compromising a patient’s private health information. 

If an email with PHI gets into the hands of the wrong person, or is accessed without permission, record the incident and determine if a HIPAA breach notification is required. 

Report these to affected patients, as well as the U.S. Department of Health and Human Services (HHS), and if the breach is massive, you may need to involve the media as well.

Encourage patients to use secure patient portals or encrypted email attachments where applicable, and do not put patient information in the subject line.  Generally, HIPAA permits unencrypted email when reasonable safeguards are in place if the patient requests it after being informed of the risks.

What a secure alternative actually requires

Having a privacy policy is not enough to make a messaging app HIPAA-compliant. Dental offices should review its data security measures before sharing patient information, such as X-rays, treatment plans, or billing details.

Look for platforms that provide data encryption and adhere to the Security Rule of the HIPAA guidelines. Ensure patient information is accessible only to authorized personnel through secure logins and access controls. Regularly check systems audit logs to monitor access to and sharing of patient information. 

OCR handles HIPAA complaints and oversees the implementation of the HIPAA Privacy and Security Rules, which include guidelines for the protection of electronic patient information. 

It shows how much the enforcement efforts and breach reports are an important measure for dental practices to consider when it comes to compliance and communication security. 

Delayed or Denied Patient Access to Dental Records

Under HIPAA, patients have the right to access their dental records, including clinical notes, X-rays, and billing information. Excessive fees or delays may violate federal law and lead to enforcement action. 

The 30-day access requirement

HIPAA regulations allow patients to access their dental records usually within 30 calendar days of a request. The practice can obtain one extension of up to 30 calendar days if it cannot meet this deadline.

Practice may extend for one 30-day period, but shall provide the patient with written notice during the first 30-day period explaining the delay and projected date of completion.

If a patient requests records electronically, provide them in that format. In case a practice fails to respond within the required timeframe, the patient may file a complaint with OCR. 

In September 2022, three dental practices agreed to pay a combined $135,000 to settle a federal investigation into delayed patient records access and, in one case, an excessive copying fee. 

The case illustrates that, beyond any paper issue, there are significant financial sanctions and corrective measures associated with a breach of HIPAA.

To prevent these issues, designate a person to make record requests. He must note the date on which a record request is received and set an alert for 20 days. This way, you have time to complete the record before the deadline. 

Make sure you also check rules for state-specific medical records access timelines, as some states have additional requirements or shorter deadlines for providing patient records. 

What counts as an excessive fee

HIPAA places restrictions on the amount that dental practices may charge patients for copies of their records. You violate federal law if you charge per page or a record fee higher than what HIPAA allows.

HIPAA limits fees for providing copies of patient records. Permitted costs may include labor, supplies, and postage, where applicable. Fees for searching for records generally cannot be included.

Use a reasonable average cost schedule or calculate actual allowable cost when you measure the price for electronic copies. Under certain conditions, an optional flat fee up to $6.50 may be charged for electronic copies of qualifying records. 

In September 2022, a Georgia dental practice agreed to pay an $80,000 settlement after a patient waited about 15 months for her records. The practice had withheld them pending payment of a $170 copying fee. 

There was also a requirement for corrective action that had to be done in the settlement, but this was not an admission of liability.

Weak Staff Training and Outdated Risk Assessments

Human error and weak safeguards can contribute to healthcare privacy incidents. Dental practices should establish clear procedures for handling patient information and train employees to follow them.

Frequent security audits may be able to reveal vulnerabilities before they become an issue for unauthorized disclosures.

The free HHS Security Risk Assessment Tool can be used to identify security risks to electronic protected health information (ePHI) for practices that do not have a dedicated compliance officer. Practices need to address gaps identified and review assessments where systems and workflows change.

Why a one-time onboarding session isn’t enough 

Most of the examples above involve everyday habits rather than cyberattacks. Train new hires on their initial HIPAA requirements and update existing staff on HIPAA refreshers as needed, depending on workflows, technology, or privacy procedures.

Relate to real situations in a dental office, like when someone has mistakenly handed you their X-ray, overheard a discussion about treatment, or asked for a response to a negative review.

Front-desk staff should learn identity verification and patient communication, clinical staff should focus on securely sharing images, and billing staff should protect statements and use vendor portals safely. 

When administrative work outgrows the front desk, it helps to see how small practices bring in trained outside support for routine tasks without compromising HIPAA safeguards. 

When a risk assessment needs to be redone 

You need to redo a risk assessment when significant changes occur at your practice. 

These include adopting new software or imaging equipment, opening a new location, or giving a remote employee access to patient records. 

If you plan to hire remote staff, make sure your assessment covers how they will access and handle patient information. You can also review new requirements for virtual administrative staff handling patient data before you start onboarding new employees. 

Building accountability into day-to-day front-desk work

Dental practices managing limited front-desk capacity may need to consider the broader healthcare staffing shortage driving these compliance gaps when evaluating how to maintain consistent administrative support and protect patient information. 

Outsourced administrative professionals can assist with routine tasks while following established HIPAA procedures and the practice’s privacy policies.

You can delegate intake and scheduling to a trained administrator who verifies patient identities, protects patient information, and escalates patient reviews to the owner for a response. 

Clear responsibilities and consistent procedures help your front desk protect patient information even during business shifts. 

Next Step to Avoid Dental HIPAA Violations

One overlooked detail can put your dental practice at risk. A public review response, a missing Business Associate Agreement, or a delayed records request can lead to privacy complaints, costly penalties, and lost patient trust.

The best way to prevent dental HIPAA violations is to make compliance part of your daily workflow. Review your privacy policies, secure patient communications, verify vendor agreements, and keep your security risk assessment up to date. Train staff regularly and assign clear responsibility for records requests, equipment disposal, and patient information handling. 

If your front desk is stretched thin, trained virtual dental administrative support can help with intake, scheduling, and routine follow-ups. Before granting outside support access to patient information, implement the necessary privacy safeguards. Ensure that all required agreements are signed. 

Protecting patient privacy starts with consistent habits, clear accountability, and the right safeguards at every step.