What is HIPAA and Why is it Important for Your Practice?

Last updated August 26, 2026

Important Disclaimer: This article is intended for general educational purposes and does not constitute legal or healthcare compliance advice.   Navigating HIPAA compliance can be daunting, and there is no one-size-fits-all solution.  For guidance on your specific compliance obligations, please consult with your own qualified legal counsel or professional compliance advisor.  

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that establishes national standards for protecting protected health information (PHI). PHI includes all individually identifiable information related to a patient’s medical condition, medical treatment, or payment for medical services. That definition can be further broken down into the following two components, both of which must be present for information to be considered PHI: 

For dental practices (called “covered entities” under HIPAA), HIPAA compliance is not optional — it is a legal obligation. HIPAA ensures: 

• PHI is used and disclosed only for authorized purposes. 
• Safeguards are in place to prevent unauthorized access. 
• Covered entities and their business associates are held accountable for violations, with civil and criminal penalties possible. 

Why HIPAA Matters for Dental Offices

Dental Offices handle large volumes of PHI every day – from patient charts and x-rays to billing information and insurance claims.  Even seemingly minor lapses, like leaving a patient file on a desk or failing to lock a computer screen, can cause a HIPAA incident or even violation. 

HIPAA is crucial because it: 

• Protects patient trust – Patients expect their sensitive information to remain private. 
• Reduces liability – Noncompliance can result in steep fines and legal exposure. 
• Ensures operational integrity – Secure systems reduce risks of data breaches and fraud.

Core HIPAA Safeguards: What You Must Do

To meet HIPAA’s Privacy and Security Rule requirements, dental practices must implement three categories of safeguards: 

1. Administrative Safeguards

Policies, procedures and training to manage PHI securely.  For example (NOT an exhaustive list): 

• Maintain a written HIPAA policy covering the use, storage and disclosure of PHI.
• Conduct regular risk assessments to identify and mitigate security vulnerabilities. 
• Provide and document annual HIPAA training for employees. 
• Limit access to PHI to only those individuals with a legitimate “need-to-know.”

2. Technical Safeguards

Technology-based protections for electronic PHI. For example (NOT an exhaustive list): 

• Require strong, unique passwords for all accounts. 
• Use two-factor authentication where possible. 
• Keep practice management and EHR systems updated with security patches. 
• Encrypt all PHI in storage and during transmission; never use unencrypted email or text. 
• Consider secure password managers and VPNs for remote access. 

3. Physical Safeguards

Measures that protect physical access to PHI. For example (NOT an exhaustive list):  

• Position monitors so screens aren’t visible to patients or the public. 
• Lock or shut down computers when unattended. 
• Store paper files securely, away from public areas. 
• Keep office doors closed when handling PHI in private spaces. 

Common HIPAA Incidents in Dental Offices 

• Accessing patient records without a work-related purpose.
• Using personal devices to handle PHI without encryption or a secure VPN.
• Losing an unencrypted laptop, phone or external drive containing PHI.
• Disclosing PHI without valid patient authorization or another legal basis.

How Does HIPAA Apply to Dental Billing Companies?

HIPAA extends beyond dental practices to include business associates, such as dental billing companies like eAssist. When dental billing companies access, transmit, or store PHI on behalf of a practice, they are bound by the same HIPAA requirements as the practice itself. 

Key Requirements for Billing Companies: 

• Enter into a Business Associate Agreement (BAA) with each dental practice. 
• Ensure PHI is transmitted only through encrypted, secure channels. 
• Store PHI in compliance with administrative, technical and physical safeguard standards.
• Train employees on HIPAA compliance and restrict access to the PHI of each client only to authorized employees. 

Since dental insurance claims involve the electronic transmission of PHI, dental billing companies are fully subject to HIPAA’s Privacy and Security Rules.  Both dental practices and dental billing companies they work with share the responsibility for protecting PHI.  

eAssist and HIPAA

At eAssist, we take HIPAA compliance seriously. We use secure, encrypted methods — including Virtual Private Network (VPN) connections — to access your patient data without storing PHI on our own hardware. While eAssist provides these and other safeguards, the dental office remains responsible for maintaining a HIPAA-compliant environment and ensuring that all employees follow proper procedures.

For more information on HIPAA compliance for dental practices, see:

• HIPAA Compliance for Dentists
• HIPAA Information and Resources for Compliance
• HIPAA Rules for Dentists
• https://www.hhs.gov/hipaa/for-professionals/training/index.html
• https://www.cdc.gov/phlp/php/resources/health-insurance-portability-and-accountability-act-of-1996-hipaa.html