HIPAA Audit Readiness Guide for Multi-Location Dental Groups

A multi-location dental group needs to show how its policies work across individual offices, shared systems, and outside service providers. Start by identifying which legal entities in the group are covered entities or business associates; the rules apply based on an entity’s role under HIPAA, not simply its brand or ownership structure. HHS guidance on covered entities and business associates explains the distinction.

Use this guide to organize evidence, identify gaps, and show how your HIPAA program protects electronic protected health information (ePHI) across the group. Audit readiness is an ongoing process—not a one-time checklist.

How should multi-location dental groups conduct and document a HIPAA risk analysis?

Conduct one coordinated electronic protected health information risk analysis that accounts for the group’s full ePHI environment, while documenting meaningful differences among locations. The analysis should cover ePHI the organization creates, receives, maintains, or transmits, including information in practice-management and imaging systems, backups, email, mobile devices, remote-access tools, and vendor platforms. HHS risk-analysis guidance says the analysis must encompass ePHI across electronic media and connected locations.

For each relevant system, location, and information flow, record the threats and vulnerabilities considered, existing safeguards, likelihood and potential impact of risks, and the steps planned to address them. Include how risks were prioritized, who owns each action, its target date, and whether risk remains after controls are applied. The Security Rule requires an accurate and thorough assessment of risks and vulnerabilities to ePHI’s confidentiality, integrity, and availability, followed by risk management. See 45 C.F.R. § 164.308.

Keep the method, scope, findings, and decisions in a written or electronic record. HHS does not prescribe a particular risk-analysis format, so use a consistent method that reflects your actual systems and operations. A short summary without supporting evidence may not demonstrate how the group identified and addressed risks. HHS guidance on risk-analysis documentation describes the documentation as an input to risk management.

Which audit documents should dental groups maintain and provide?

Maintain a centrally organized, access-controlled repository that lets you locate current group policies and the evidence supporting how they are applied at each office. The exact records to provide depend on the scope of a review; the HHS HIPAA audit protocol describes evidence reviewers may examine for selected Privacy, Security, and Breach Notification Rule requirements.

A practical audit file may include:

• Risk-analysis records, risk-management decisions, remediation plans, and evidence that completed actions were implemented.
• Current HIPAA security policies and procedures, including version dates and records of updates.
• The identity and responsibilities of the security official, along with applicable workforce access and termination procedures.
• Evidence of safeguards in practice, such as access approvals, system activity reviews, security incident records, and relevant training documentation.
• Business associate agreements (BAAs), a vendor inventory, and relevant subcontractor assurances.
• Patient access request records and, where applicable, breach assessment and notification documentation.

HIPAA-required Security Rule documentation must generally be retained for six years from its creation or the date it was last in effect, whichever is later. This is a retention rule for required documentation—not a universal HIPAA retention period for dental or patient records. Check 45 C.F.R. § 164.316, and assess other applicable record-retention requirements separately.

How should workforce access to ePHI be assigned and reviewed?

Use workforce role-based access: define the ePHI and systems needed for each job function, then grant access that supports those duties. A dentist or clinical team member may need access to records for care, while billing, scheduling, and administrative roles may need different access. HIPAA’s minimum-necessary rule generally calls for reasonable limits on workforce access, but it does not apply to disclosures to or requests by health care providers for treatment. See HHS minimum-necessary guidance.

Document who approved access, which systems and locations it covers, and any changes when duties, employment, or work arrangements change. Use unique user IDs rather than shared logins so activity can be linked to an individual user; the Security Rule requires unique user identification for systems containing ePHI. 45 C.F.R. § 164.312 also addresses access controls and audit controls.

Review access periodically as a group practice and when job changes, transfers, departures, or security events make a review appropriate. The rule requires appropriate workforce access procedures and regular review of information-system activity, but it does not set one universal schedule for manager access certifications. Keep records of the review, decisions, and resulting changes.

What safeguards and security-official responsibilities apply across locations?

The Security Rule calls for administrative, physical, and technical safeguards that are reasonable and appropriate for the organization. For a dental group, assess centrally managed systems as well as office-specific risks, including workstations, imaging equipment, records areas, network equipment, and how staff handle information when working across locations. See HHS’s summary of the HIPAA Security Rule.

Relevant safeguards include policies for security management and workforce access; physical controls for facilities and equipment; and technical controls such as unique user identification, audit mechanisms, authentication, and transmission security. Some implementation specifications are labeled “addressable.” That does not make them optional by default: the organization must assess whether the specification is reasonable and appropriate, implement it when appropriate, or document why it is not and any reasonable alternative. Physical safeguards and technical safeguards are set out in the regulations.

Identify a security official responsible for developing and implementing Security Rule policies and procedures. The regulation requires the covered entity or business associate to identify that official; it does not require a separate official at every office. A group may assign local contacts to support a central official, provided responsibilities and escalation paths are clear. See 45 C.F.R. § 164.308.

How can dental groups verify business associate agreements and subcontractor assurances?

Maintain an inventory of vendors that create, receive, maintain, or transmit PHI on the group’s behalf, and determine whether each relationship requires a BAA. Potential examples include certain practice-management, cloud-hosting, imaging, billing, and IT services. Do not assume every supplier is a business associate; assess what the service provider does and how it handles PHI.

Before permitting a business associate to handle PHI, confirm that a written agreement is in place and covers applicable business associate agreement requirements. Terms generally address permitted uses and disclosures, safeguards, reporting of impermissible uses or disclosures, access to records for patient requests, and the handling of PHI when the agreement ends. HHS’s sample BAA provisions outline required terms.

Ask business associates to ensure that subcontractors handling PHI accept the required restrictions and conditions. Keep signed agreements, effective dates, amendments, and a record of which services and locations each agreement covers. Reviewing vendor security information is a useful oversight practice, but do not treat a vendor certificate or questionnaire as a replacement for the required agreement or your own risk analysis.

How should teams document patient access requests and breach assessments?

Use a consistent patient right of access procedures workflow across offices, with a clear route for staff to send requests to the responsible team. Track the request’s receipt date, records sought, actions taken to locate them, response or denial, delivery method, and completion date. HIPAA generally requires the covered entity to act on an access request within 30 calendar days; one extension of up to 30 additional days is allowed when the individual receives a written explanation and expected completion date within the initial period. See HHS guidance on access-request timelines.

For a suspected impermissible use or disclosure, record what was reported, when the organization learned of it, how the incident was contained and investigated, and the basis for the breach determination. If relying on a low probability of compromise to conclude notification is not required, document the required breach risk assessment documentation, including the nature and extent of the PHI, the recipient or person involved, whether the information was actually acquired or viewed, and the extent to which the risk was mitigated. HHS breach-notification guidance describes these factors and the obligation to document the decision.

If notification is required, retain evidence of the notifications and related actions. The group should have a defined escalation process so local staff promptly report suspected incidents to the appropriate response team. Use secure channels for incident records and provide only information relevant to the review.

When should HIPAA evaluations be repeated and remediation plans reviewed?

HIPAA does not set a universal annual deadline for repeating a risk analysis. HHS says the frequency depends on the organization’s circumstances and that risk analysis should be an ongoing process. Reassess when changes—such as a new location, acquisition, system, vendor, workflow, or security incident—could affect ePHI risks. HHS risk-analysis guidance discusses frequency and operational changes.

Separately, the Security Rule requires periodic technical and nontechnical evaluations of how well security policies and procedures meet its requirements. Set a schedule that reflects the group’s systems, risks, and operating changes, and document evaluation findings, remediation options, decisions, owners, target dates, and closure evidence. Review policies and required documentation periodically and update them as needed when environmental or operational changes affect ePHI security. See 45 C.F.R. § 164.308 and 45 C.F.R. § 164.316.

In short, an audit-ready dental group can show what ePHI it handles, how access and safeguards work at each location, which vendors support its operations, and how it follows through on identified risks and patient requests. Keep the evidence current, centrally organized, and connected to accountable owners.

FAQs

What records should a multi-location dental group provide during a HIPAA audit?

Provide records responsive to the audit’s scope, such as risk analyses, policies and procedures, safeguard evidence, access and system-activity review records, BAAs, patient access request logs, and breach assessments or notification records when relevant. The HHS audit protocol describes the types of evidence reviewers may examine for selected requirements.

How often should a dental group review its HIPAA risk analysis?

HIPAA does not specify a fixed risk-analysis frequency. Review it as an ongoing process and repeat or update it when organizational, operational, or technology changes may affect ePHI risks. Set a review cadence based on your environment and document the reasons for updates or decisions to retain existing controls. See HHS risk-analysis guidance.

Who should have access to ePHI at each dental office?

Workforce members should receive access appropriate to their job duties and consistent with the group’s access policies. Clinical staff may need information to support care, while administrative and billing roles should receive access aligned with their functions. Use unique user IDs, document approvals, and remove or adjust access when duties or employment change.

What should a dental group document after a suspected breach?

Document the report, discovery date, investigation and containment steps, affected PHI and individuals if known, the breach determination, and the basis for any notification decision. If the group concludes that notification is not required because there is a low probability that PHI was compromised, record the required factors and analysis. If notification is required, retain evidence of the notifications and related actions. HHS breach-notification guidance explains the assessment and documentation obligations.