HIPAA Documentation Requirements for Dental Offices: What You Must Keep and How Long

The 6 Core HIPAA Documents OCR Requests First

Every OCR dental investigation begins with the same document request. If you can produce all six of these quickly and confidently, you are in a fundamentally different position than a practice that cannot.

• 1. Security Risk Analysis (SRA): A completed, dated SRA showing the assessment was conducted within the past 12 months. Must include identified risks, risk ratings, and a corresponding risk management plan showing what was done to address each identified risk. The SRA is the single most requested document in dental OCR audits.
• 2. Business Associate Agreement log and signed BAAs: A list of all Business Associates (vendors handling PHI) and the signed BAA for each. BAAs must include HITECH breach notification requirements — pre-2013 BAAs are non-compliant. OCR requests this list and will audit specific BAAs.
• 3. HIPAA policies and procedures: Written policies covering all required areas: workforce training, access management, breach response, device and media controls, minimum necessary standards, and contingency planning. Policies must be signed, dated, and show revision history.
• 4. Staff training records: For every employee with access to PHI: name, training date, training topics covered, and an acknowledgment signature. Training that isn't documented is treated by OCR as training that didn't happen.
• 5. Notice of Privacy Practices (NPP) — all versions: The current NPP plus all prior versions, with effective dates for each. OCR checks that the NPP was updated when required (including the 2026 update) and that it was distributed to patients and posted appropriately.
• 6. Breach log: A running log of all incidents assessed for breach status — including incidents assessed and determined NOT to be reportable breaches. The log must include incident date, discovery date, number of individuals affected (if any), assessment outcome, and actions taken.

Additional Documentation Requirements

Beyond the six core documents, HIPAA requires documentation in several additional areas that dental practices frequently overlook:

• Patient rights requests: Every patient request for records access, amendment, restriction, or accounting of disclosures must be documented — including the date received, how it was handled, and the date of response. Denials must include the reason and information about the patient's right to complain to OCR.
• Workforce sanctions: When a staff member violates a HIPAA policy, the sanction applied must be documented. This demonstrates that workforce policies are enforced — not just written.
• Device and media inventory: An inventory of all hardware and electronic media that stores ePHI: computers, tablets, dental imaging equipment, portable drives. Includes assigned user, location, encryption status, and disposal records when devices are retired.
• Contingency plan testing: Backup and disaster recovery procedures must be tested periodically. Documentation of tests — date, scope, outcome — demonstrates the plan is operational, not just written.

How Long to Retain Each Document

The HIPAA retention requirement is 6 years from the date of creation or the date it was last in effect, whichever is later. This means:

• Policies and procedures: 6 years from the date each version was retired. Keep all prior versions, not just the current one.
• BAAs: 6 years from the expiration or termination of the agreement. A BAA signed in 2020 that was replaced in 2024 must be kept until at least 2030.
• Training records: 6 years from the date of training. For employees who have left the practice, keep their training records for 6 years after their departure.
• SRAs: 6 years from the date completed. Keep every annual SRA — OCR may request historical SRAs to assess whether the practice consistently conducted annual reviews.
• Breach log entries: 6 years from the date of the incident. The log must be maintained even for incidents determined not to be reportable breaches.

How to Store HIPAA Documentation

HIPAA does not specify a particular storage format — paper binders, spreadsheets, and compliance platforms all satisfy the requirement. What matters is that documentation is:

• Accessible: Retrievable within a reasonable timeframe if OCR requests it. 'It's somewhere on an old computer' is not acceptable.
• Organized: OCR document requests are typically very specific. Being able to produce a specific BAA or the SRA from a specific year quickly demonstrates an organized compliance program.
• Backed up: Compliance documentation stored only on a single computer is at risk of loss in the same ransomware incident or hardware failure that might trigger the OCR investigation.
• Protected: Ironically, your compliance documentation itself may contain PHI (training records with patient scenario details, breach logs). It should be stored with appropriate access controls.

Building a Simple HIPAA Documentation System

The most common documentation failure in dental practices is not that documents don't exist — it's that they exist in scattered locations and no one knows where everything is. A simple system prevents this.

Whether you use a shared drive folder, a cloud storage system, or a managed compliance platform, the structure should mirror the six core document categories: SRA folder, BAA folder, Policies folder, Training records folder, NPP versions folder, Breach log.

Assign one person in the practice as the documentation owner — typically the designated Privacy Officer or Office Manager. Their job is to ensure new documents are filed, old documents are retained (not deleted), and the system is accessible if OCR ever requests documentation.