How Often Should a Dental Practice Conduct a HIPAA Audit?

What HIPAA Actually Requires (vs. What's Best Practice)

HIPAA sets minimum requirements. Best practice goes further. Here is the distinction:

• Required by HIPAA: Annual Security Risk Analysis, review and update of policies and procedures when changes occur, ongoing workforce training when policies change, and documentation of all compliance activities retained for 6 years.
• Best practice (not explicitly required, but expected by OCR): Quarterly BAA audits, semi-annual policy reviews, monthly review of access logs, annual penetration testing, and an annual staff HIPAA training refresher for all employees.

The Annual HIPAA Compliance Calendar for Dental Practices

The most effective approach is to put compliance activities on a fixed calendar so nothing is missed. Here is the schedule that covers both HIPAA requirements and OCR expectations:

• January (or practice anniversary month): Complete annual Security Risk Analysis. Update risk management plan based on findings. Review and update all HIPAA policies and procedures.
• February: Complete annual staff HIPAA training. Document all completions with employee name, date, and topics covered. Update NPP if any regulatory changes occurred.
• Quarterly (every 3 months): Audit Business Associate Agreement list — verify every active vendor has a current signed BAA. Review user access logs for any anomalies. Check that terminated employees have been removed from all systems.
• Monthly: Review system access logs, verify backups completed successfully, check that any new software or vendors have BAAs in place before going live.
• As needed (triggered reviews): Any time a new vendor is onboarded, new software is implemented, a staff member with PHI access leaves, or a security incident occurs — conduct a targeted compliance review of the affected area.

What Triggers an Off-Cycle HIPAA Audit

Beyond the annual schedule, specific events require an immediate compliance review — what HIPAA calls a review of policies and procedures "in response to environmental or operational changes."

• New practice management software: New PMS means new ePHI pathways. BAA must be in place before go-live. SRA must be updated to include the new system.
• Adding a new practice location: Each physical location is a separate facility with its own physical safeguard requirements — workstation policies, facility access controls, device inventory.
• Ransomware or security incident: Any ransomware attack, phishing incident, or unauthorized access triggers an immediate breach assessment and may require a full SRA update.
• Staff turnover in key roles: When a Privacy Officer, Office Manager, or IT contact leaves, their system access must be revoked and their responsibilities formally reassigned and documented.
• Patient or employee complaint: A complaint filed with OCR automatically opens an investigation. Having current audit documentation is the primary defense.

How Long to Retain Audit Documentation

HIPAA requires documentation to be retained for 6 years from the date of creation or the date it was last in effect, whichever is later. This applies to:

• Every completed Security Risk Analysis
• All signed Business Associate Agreements
• Staff training records (name, date, topics covered, signature)
• All versions of HIPAA policies and procedures
• Breach log (including incidents that were assessed and determined not to be reportable breaches)
• Notice of Privacy Practices (each version, with effective dates)

DIY Audit vs. Managed Compliance Platform

Dental practices have two practical options for managing the annual audit cycle: DIY using HHS free tools, or a managed compliance platform.

The DIY path using the HHS SRA Tool is legitimate and free — but it requires consistent time investment from someone in the practice who understands the requirements. The typical failure mode is completing the first SRA and then not repeating it annually.

Managed platforms like Compliancy Group and Medcurity automate the reminder cycle, guide you through the SRA, track BAA expirations, and provide documentation storage. For practices without a dedicated compliance staff member, this is often the more reliable path.