HIPAA for Dental Practices: Complete Guide

HIPAA dental compliance is more important than ever for dental practices of every size. With sensitive patient data at the core of daily operations, understanding and applying HIPAA regulations is essential to protect your patients and your practice from costly violations.

This complete guide covers what every dental office needs to know about managing dental office PHI, safeguarding ePHI dental records, and maintaining patient privacy dentists are trusted to uphold. We’ll break down the key HIPAA rules, common types of patient information you handle, and the practical steps you must take to keep your practice secure and compliant.

From staff training and secure patient communication to HIPAA security dental protocols and the critical role of dental BAA agreements, you’ll find actionable strategies tailored for modern dental offices. Let’s make HIPAA compliance simple, so you can focus confidently on providing quality care while keeping patient information safe.

Why HIPAA Applies to Dental Offices

HIPAA applies to dental offices because dental practices handle a significant amount of protected health information (PHI) during everyday operations. Whether you’re managing insurance claims, storing patient histories, or communicating treatment plans, this information is highly sensitive and protected under federal law. The Health Insurance Portability and Accountability Act (HIPAA) was specifically designed to ensure that all healthcare providers, including dentists, protect patient data from unauthorized access or disclosure.

Dental offices often collect and store details such as patient names, addresses, treatment details, health histories, insurance information, and even Social Security numbers. When transmitted or stored electronically, this data becomes ePHI dental records, which must be secured according to HIPAA’s security standards. By handling this kind of information, dental practices are considered “covered entities” and are legally required to comply with HIPAA regulations.

HIPAA dental compliance isn’t just about following the law—it’s about earning and maintaining your patients’ trust. Patients expect that their health information will remain private and secure, and any breach can quickly erode confidence in your practice. Furthermore, the risk of cyber threats targeting healthcare data is growing, making HIPAA security dental measures a critical part of any dental office’s operations.

Another important aspect is working with outside vendors or service providers who may have access to your patient information. Every dental office must have a dental BAA (Business Associate Agreement) in place with any third party that interacts with PHI. This agreement ensures that all parties take responsibility for protecting sensitive data, extending your compliance efforts beyond your own team to include all business associates.

In summary, HIPAA applies to dental offices because:

• Dental offices routinely create, store, and transmit PHI and ePHI.
• Patients trust dentists to protect their privacy and sensitive information.
• Legal requirements mandate robust data protection and privacy practices.
• Business associates with access to PHI require formal agreements (dental BAA) to ensure shared compliance.
• Increasing cyber risks demand strong HIPAA security dental strategies to protect against data breaches.

By understanding why HIPAA is relevant, we can better appreciate the importance of building secure systems and policies that protect dental office PHI and uphold the highest standards of patient privacy dentists can offer.

Key HIPAA Rules for Dentists (Privacy & Security)

Key HIPAA Rules for Dentists (Privacy & Security)

When it comes to HIPAA dental compliance, two main rules shape every aspect of how dental practices manage, store, and share patient information: the Privacy Rule and the Security Rule. These rules ensure every dental office PHI—whether on paper or in digital form—is handled responsibly and securely.

The HIPAA Privacy Rule establishes national standards for the protection of patient health information. For dentists, this means:

• Limiting Uses and Disclosures: Patient information (PHI) can only be used or shared for treatment, payment, or healthcare operations—unless the patient gives explicit permission or there’s a legal requirement.
• Minimum Necessary Standard: Only the minimum amount of PHI necessary to accomplish the intended purpose should be accessed or disclosed. This helps reinforce patient privacy dentists are trusted to protect.
• Patient Rights: Patients have the right to access, review, and request corrections to their dental records. They must also receive a Notice of Privacy Practices outlining how their information will be used and protected.
• Written Authorizations: Any sharing of PHI beyond standard care and operations requires a written patient authorization. This is especially important for marketing purposes or sharing with third parties not directly involved in care.

The HIPAA Security Rule is all about safeguarding ePHI dental records. It requires dental practices to implement measures that protect electronic PHI (ePHI) from threats like hacking, unauthorized access, and data loss. Key requirements include:

• Administrative Safeguards: Appointing a privacy or security officer, conducting regular risk assessments, and training staff on correct procedures are crucial for HIPAA security dental compliance.
• Technical Safeguards: Use of access controls, strong passwords, encryption, and secure backup systems prevents unauthorized digital access. Two-factor authentication and audit logs add extra layers of protection.
• Physical Safeguards: Dental offices must secure physical access to computers, servers, and storage areas. This includes locking file cabinets and restricting access to authorized personnel only.

Dental Business Associate Agreements (BAAs) are another critical part of compliance. Any third-party service (like billing companies or cloud storage providers) that handles dental office PHI must sign a dental BAA. This contract legally requires them to safeguard PHI and report breaches—protecting your patients and your practice from shared liability.

By following these essential rules, we ensure that every piece of ePHI dental records and paper-based PHI is protected. Embracing these standards not only avoids regulatory penalties but also builds trust—making patient privacy dentists a promise we keep every day.

Common PHI in a Dental Setting

Common PHI in a Dental Setting

Within a dental practice, the types of protected health information (PHI) you handle go beyond just clinical notes. Understanding what qualifies as PHI is crucial for HIPAA dental compliance and ensuring robust HIPAA security dental measures. PHI includes any information that can identify a patient and relates to their past, present, or future health, treatment, or payment for care.

Here’s a breakdown of the most common types of PHI you’ll encounter in a dental office:

• Patient Names and Contact Information – Full names, addresses, phone numbers, and email addresses are all considered PHI.
• Social Security Numbers and Identification Numbers – These are especially sensitive and often included in dental records for insurance or identification purposes.
• Insurance and Payment Details – Policy numbers, billing records, and account numbers tied to a patient’s dental care are protected under HIPAA.
• Medical and Dental History – Notes from dental exams, diagnoses, treatment plans, X-rays, prescriptions, and referrals all qualify as PHI.
• Appointment Information – Dates and times of appointments, cancellations, and reminders sent to patients are also PHI if they can be linked to an individual.
• Photographs and Imaging – Intraoral photos, full facial images, or radiographs are considered PHI if they can be used to identify a patient.
• Electronic Health Information – Any information stored or transmitted digitally, such as in ePHI dental records, falls under the HIPAA Security Rule and requires technical safeguards.
• Correspondence with Other Providers – Referral letters, consultation notes, and communication with specialists often contain PHI and must be secured appropriately.

Every piece of this data—whether paper-based or digital—must be protected. This includes sharing information with business associates. For instance, if you use a third-party billing service or cloud-based dental software, a dental BAA (Business Associate Agreement) is required to ensure they also comply with HIPAA regulations.

Staying vigilant about what constitutes PHI helps reinforce patient privacy dentists are expected to uphold and ensures your practice meets all necessary compliance standards.

Patient Consent and Authorization Forms

Patient Consent and Authorization Forms play a critical role in HIPAA dental compliance. Every dental practice must obtain proper consent and authorization before using or disclosing a patient’s dental office PHI for purposes outside routine treatment, payment, or healthcare operations. These forms are not just paperwork—they’re your first line of defense in protecting patient privacy dentists must uphold.

Consent and authorization are often confused, yet they serve distinct purposes:

• Consent generally allows the use and disclosure of PHI for treatment, payment, and healthcare operations. Most dental offices include this in their intake paperwork, ensuring patients know how their information will be used within the practice.
• Authorization is required when a dental office needs to use or disclose PHI for reasons not covered under the general consent—such as sharing information with a family member, employer, or for marketing purposes. This form must specifically describe the information, the purpose, and the party to whom the information will be disclosed.

To maintain HIPAA security dental standards, authorization forms must include:

• A clear description of the information being released (e.g., specific dental records or ePHI dental records).
• The purpose of the disclosure.
• The recipient of the information.
• An expiration date or event after which the authorization is no longer valid.
• The patient’s signature and date.
• A statement informing the patient of their right to revoke the authorization in writing at any time.

Best practices for dental offices include regularly reviewing and updating consent and authorization forms to reflect current laws and technology. For example, if your practice adopts new digital systems for managing ePHI dental records, your forms should mention these changes. Always keep signed forms securely stored, whether in paper files or encrypted digital platforms, as part of your HIPAA security dental procedures.

Remember, some disclosures—such as those to insurance companies or business associates—require a signed dental BAA to ensure all parties handle PHI appropriately. Never disclose a patient’s information for marketing, research, or other non-standard purposes without explicit written authorization.

By making consent and authorization a priority, we not only comply with HIPAA but also build trust, showing our patients that their privacy is at the heart of our dental practice.

Safeguarding Electronic Patient Records (ePHI)

Safeguarding Electronic Patient Records (ePHI)

When it comes to HIPAA dental compliance, protecting electronic protected health information—known as ePHI dental records—is a top priority for every dental practice. Patient trust relies on our ability to keep their health details confidential and secure, especially as more information is stored and transmitted digitally.

Here’s what you need to know to ensure your dental office is safeguarding ePHI in line with HIPAA security dental requirements:

• Access Controls: Limit access to ePHI only to authorized staff. Use strong, unique passwords and two-factor authentication wherever possible. Regularly review user access rights so only those who need information for their job can reach it.
• Data Encryption: Encrypt ePHI both in transit and at rest. This means that whether records are being sent via email or stored on a server, they remain unreadable to anyone without proper authorization.
• Audit Trails: Implement software that logs who accesses patient records and when. Periodically review these logs to detect any unauthorized access or unusual activity.
• Secure Backups: Regularly back up all ePHI to a secure, off-site location or encrypted cloud service. Test these backups to ensure you can restore data quickly in the event of ransomware or hardware failure.
• Device Security: Protect computers, tablets, and mobile devices with updated antivirus software, firewalls, and remote-wipe capabilities in case they’re lost or stolen. Never leave devices with ePHI unattended or unlocked in public areas.
• Staff Training: Consistent, ongoing training is essential. Make sure every team member understands how to handle ePHI, spot phishing attempts, and properly report suspicious incidents.
• Business Associate Agreements (BAAs): Any vendor or third-party service provider that handles ePHI—such as IT support or cloud storage—must sign a dental BAA. These agreements legally bind them to follow HIPAA standards and help protect your practice in the event of a breach.

Taking these steps doesn’t just protect dental office PHI—it builds a culture of trust and responsibility within your team. We all play a role in defending patient privacy dentists are expected to uphold. By staying proactive and vigilant, you ensure your dental practice remains compliant, secure, and worthy of your patients’ confidence.

Staff Training on HIPAA Requirements

Staff Training on HIPAA Requirements is a fundamental part of HIPAA dental compliance and the foundation for a secure dental office environment. Every team member—from front desk to clinicians—must be equipped to handle dental office PHI and ePHI dental records with care and confidence.

Effective training ensures everyone understands the importance of patient privacy dentists are obligated to uphold. It also reduces the risk of unintentional violations that can lead to penalties or erode patient trust. Here’s what comprehensive staff training should include:

• Understanding PHI and ePHI: Staff should know what constitutes protected health information and the difference between paper and electronic records. Emphasize examples from daily dental practice.
• Recognizing HIPAA Security Risks: Training must highlight common threats—like phishing emails, unauthorized access, and improper disposal of records—that put HIPAA security dental at risk.
• Role-Based Access: Teach employees the principle of minimum necessary access. Each person should only access the patient data required for their role, and know how to report suspicious activity.
• Proper Use of Technology: Educate on the secure use of practice management systems, encrypted messaging, and secure email protocols. Demonstrate how to handle ePHI dental records safely on all devices.
• Physical Security Measures: Reinforce the importance of securing paper records, computers, and devices—especially in areas accessible to the public or visitors.
• Handling Business Associates: Make sure staff understand what a dental BAA (Business Associate Agreement) is, and when it is required before sharing any patient information with third-party vendors.
• Incident Response: Team members need to know exactly what to do in case of a suspected breach, including who to notify and how to document the event, following your established protocols.

For training to be truly effective, consider these best practices:

• Onboarding and Annual Refreshers: Provide HIPAA training for all new hires and repeat it at least annually to reinforce best practices.
• Interactive Scenarios: Use real-life examples and role-playing to make learning relatable and memorable for all staff members.
• Clear Documentation: Keep records of all training sessions, attendee signatures, and dates. This is crucial for demonstrating compliance during audits.
• Open Communication: Foster a culture where employees feel comfortable asking questions about HIPAA dental compliance and reporting concerns without fear of retaliation.

By investing in thorough, ongoing staff training, we not only minimize the risk of breaches but also foster a practice where patient privacy is a shared priority. This commitment helps safeguard your reputation, maintain compliance, and—most importantly—strengthen the trust your patients place in your dental care team.

Conducting a HIPAA Risk Assessment for Dental Offices

Conducting a HIPAA Risk Assessment for Dental Offices

Every dental office committed to HIPAA dental compliance must regularly conduct a thorough risk assessment. This process is not just a regulatory checkbox—it's your first line of defense in protecting dental office PHI, ensuring patient privacy dentists are trusted for, and maintaining the integrity of your ePHI dental records.

What is a HIPAA risk assessment? In simple terms, it’s a systematic review of your office’s administrative, physical, and technical safeguards to identify risks and vulnerabilities to the confidentiality, integrity, and availability of PHI and ePHI. For dental practices, this means evaluating every way patient information is accessed, used, stored, and shared.

Why does it matter? A risk assessment is required under the HIPAA Security Rule. It helps you spot gaps before they lead to data breaches or violations, which could result in financial penalties and loss of patient trust.

How to conduct a HIPAA risk assessment in your dental office:

• Inventory your PHI and ePHI: List where dental office PHI and ePHI dental records are created, received, stored, and transmitted. This includes paper files, practice management software, cloud storage, emails, and mobile devices.
• Identify potential threats and vulnerabilities: Consider risks such as unauthorized access, malware, lost devices, or even human error. Think about both digital and physical threats.
• Assess current safeguards: Review your existing security measures. Are your access controls, encryption, backup procedures, and office security up to date and effective?
• Evaluate the likelihood and impact of risks: For each threat, determine how likely it is to occur and what the potential consequences would be for your patients and your practice.
• Document your findings: Keep detailed records of your assessment process, identified risks, and the measures you have in place. This documentation is vital for demonstrating HIPAA dental compliance during audits.
• Develop and implement a risk management plan: Prioritize the most significant risks and create an action plan to address them. This may involve updating policies, improving training, or investing in new security technology.
• Review business associate agreements (BAAs): Ensure every vendor or partner with access to dental office PHI or ePHI dental records has a current, compliant dental BAA in place.
• Repeat assessments regularly: Risks and technology change. Revisit your assessment at least annually or whenever you introduce new systems or processes involving PHI.

By making the risk assessment a routine part of your practice, you foster a culture of HIPAA security dental and patient trust. It’s a proactive step that not only protects sensitive data but also demonstrates your commitment to excellence in care and compliance.

Business Associate Agreements with Dental Vendors

Business Associate Agreements with Dental Vendors

Every dental practice relies on a network of vendors and partners—think labs, IT providers, cloud storage services, billing companies, and more. If any of these third parties have access to your dental office PHI or handle ePHI dental records on your behalf, HIPAA classifies them as business associates. To maintain HIPAA dental compliance, you must have a formal contract in place: the dental BAA (Business Associate Agreement).

A dental BAA is a legal document that outlines how your vendors will protect and use patient information. It’s not just a formality—HIPAA requires it. Without a compliant BAA, your practice is directly responsible for any mishandling of PHI, even if the breach happens on the vendor’s side. This is why understanding and managing BAAs is a key part of HIPAA security dental programs.

Here’s how to handle business associate agreements effectively:

• Identify all vendors who access patient data: Make a list of any third party that could potentially view, store, transmit, or process PHI or ePHI. This includes IT support, software providers, shredding services, and even consultants.
• Require a signed BAA before sharing PHI: Never share patient information with a vendor until a dental BAA is in place. The agreement should detail the permitted uses, required safeguards, and steps the vendor will take in case of a breach.
• Ensure the BAA covers HIPAA standards: The agreement must address administrative, physical, and technical safeguards that align with HIPAA rules, including breach notification protocols and the vendor’s responsibilities for protecting patient privacy dentists are obligated to uphold.
• Review and update regularly: Business relationships and technology change. Review your BAAs periodically to ensure they reflect current operations and legal requirements. If you switch vendors or change services, update your agreements promptly.
• Audit vendor compliance: Don’t just file away the agreement—ask vendors about their HIPAA training, security practices, and incident response plans. This due diligence helps protect your practice in the event of an audit or data breach.

Remember, failing to secure proper BAAs can result in severe fines and reputational damage. By treating business associate agreements as a non-negotiable part of your HIPAA program, we can safeguard dental office PHI, maintain patient trust, and ensure our practice remains compliant in a digital world.

Secure Communication with Patients

Secure Communication with Patients is a cornerstone of HIPAA dental compliance. Every digital interaction, whether by email, text, or online portals, must prioritize the confidentiality and security of dental office PHI. As dental professionals, we’re responsible for maintaining patient privacy dentists and teams are trusted to uphold, especially when discussing treatment or sharing sensitive information electronically.

To ensure HIPAA security dental standards are met, it’s vital to use communication channels that are encrypted and specifically designed for transmitting ePHI dental records. Here’s how you can strengthen your patient communication protocols:

• Choose HIPAA-compliant platforms: Only use email, messaging apps, and patient portals that offer end-to-end encryption and are willing to sign a dental BAA (Business Associate Agreement). This legally binds the vendor to maintain the security and privacy of dental office PHI.
• Educate your team: Train your staff regularly on handling patient communications, including recognizing phishing attempts and following protocols for sharing PHI.
• Obtain patient consent: Before communicating via email or text, get written authorization from patients. Explain the risks and document their preferences for electronic communication.
• Limit information shared: Share only the minimum necessary information required for the communication. Avoid including details like Social Security numbers or full medical histories unless absolutely necessary.
• Monitor access and audit trails: Use systems that track who accesses or transmits ePHI dental records. Regularly audit these logs for unauthorized activity.
• Be cautious with attachments: Whenever possible, direct patients to secure portals instead of sending attachments by email. If you must send an attachment, use password protection and separate channels to communicate passwords.

By following these best practices, we can reassure our patients that their privacy is a top priority and that our practice is committed to HIPAA dental compliance at every touchpoint. This not only protects your patients but also safeguards your dental office from potential violations and strengthens the trust that is essential in patient care.

Physical Security in Dental Practices

Physical Security in Dental Practices plays a crucial role in maintaining HIPAA dental compliance. While digital safeguards often get the spotlight, physical measures are just as important for protecting dental office PHI and ensuring patient privacy dentists are required to uphold.

Physical security aims to stop unauthorized access to patient information stored on paper or on devices within your office. Here’s how we can ensure our dental practice is truly secure:

• Control Access to Sensitive Areas: Limit entry to rooms where ePHI dental records or other protected information is stored. Use locks, keycards, or access codes for offices, file rooms, and server closets. Only authorized staff should be allowed inside these spaces.
• Secure Paper Records: Store all documents containing PHI in locked cabinets or rooms. Never leave patient files on open desks, at reception, or in shared spaces where anyone could see or take them.
• Protect Electronic Devices: Laptops, tablets, and USB drives holding patient data should be physically secured when not in use. Use cable locks for computers and store portable devices in locked drawers or cabinets.
• Monitor Visitors and Vendors: Always accompany visitors, including vendors or maintenance staff, if they need to enter areas where PHI is present. Keep a visitor log for added accountability.
• Proper Device and Media Disposal: When retiring old hardware or shredding documents, follow a documented process to ensure complete destruction of PHI. Cross-cut shredders are ideal for paper; consider professional e-waste services for electronics.
• Video Surveillance and Alarms: Install cameras and alarm systems in high-risk areas to deter unauthorized access. Just be sure cameras do not capture computer screens or patient paperwork to avoid accidental exposure.
• Staff Training and Awareness: Physical security only works if everyone understands its importance. Train your team regularly to recognize potential risks, such as tailgating (unauthorized people following staff into secure areas) or improper document handling.

All of these steps help ensure HIPAA security dental standards are met, reducing the risk of breaches due to theft, unauthorized access, or negligence. Remember, protecting patient data isn’t just about technology—physical safeguards are a critical defense in your compliance strategy, and they’re often the first line of protection for ePHI dental records and all other forms of PHI.

Finally, don’t forget that if you work with outside service providers who handle access to your premises or records, a dental BAA (Business Associate Agreement) is required to clarify their responsibilities in protecting your patients’ information. When we commit to strong physical security, we show our patients that their privacy truly matters.

HIPAA dental compliance is more important than ever for dental practices of every size. With sensitive patient data at the core of daily operations, understanding and applying HIPAA regulations is essential to protect your patients and your practice from costly violations.

This complete guide covers what every dental office needs to know about managing dental office PHI, safeguarding ePHI dental records, and maintaining patient privacy dentists are trusted to uphold. From the basics of the Privacy and Security Rules to the importance of strong administrative, technical, and physical safeguards, we’ve highlighted the key steps to help your office stay compliant.

We encourage you to review your policies regularly, ensure your team is trained on HIPAA security dental requirements, and keep your technology up to date. Don’t forget to have a thorough dental BAA in place with every partner who handles PHI or ePHI on your behalf. These measures are not just about legal protection—they’re about earning and keeping your patients’ trust.

By putting patient privacy first and making compliance part of your daily routine, you’ll create a safer environment for everyone. If you’re ever unsure, consult a HIPAA expert to help you navigate new regulations and best practices. Protecting dental office PHI and ePHI dental records is a responsibility we all share—let’s get it right, together.

FAQs

Is my dental office a covered entity under HIPAA?

Yes, most dental offices are considered covered entities under HIPAA. If your practice transmits any patient information—such as insurance claims, treatment authorizations, or eligibility checks—electronically, you fall under HIPAA dental compliance rules. This applies whether you send this information directly, use a clearinghouse, or work with a business associate who handles dental office PHI on your behalf.

Being a covered entity means you must protect patient privacy and secure both physical and electronic protected health information (ePHI dental records). Dentists and their teams are responsible for following HIPAA security dental standards, ensuring patient privacy dentists are upheld in daily operations.

If your office works with outside vendors (like billing or IT support) who can access PHI, you’ll also need a dental BAA (Business Associate Agreement) with each one. This ensures everyone involved in handling your patients’ data meets HIPAA’s strict privacy and security requirements.

In short, unless your dental office never deals with electronic transactions or outside partners, you’re likely a covered entity—and complying with HIPAA is essential for protecting your patients and your practice.

What specific HIPAA rules affect dental practices?

Dental practices are directly affected by several key HIPAA rules that govern how patient information is handled, stored, and shared. The HIPAA Privacy Rule sets national standards to protect dental office PHI (protected health information), ensuring patient privacy for dentists and outlining when and how patient data can be disclosed. This rule grants patients rights over their health records and mandates that dental offices provide clear notices of privacy practices.

The HIPAA Security Rule specifically addresses the protection of ePHI dental records (electronic protected health information). It requires dental offices to implement administrative, technical, and physical safeguards to prevent unauthorized access, ensuring robust HIPAA security in dental environments.

Additionally, the HIPAA Breach Notification Rule requires dental practices to notify affected individuals and authorities in the event of a breach involving PHI or ePHI. The Omnibus Rule further clarifies that business associates, such as third-party billing or IT firms, must also comply—making it essential to have a signed dental BAA (business associate agreement) with any partner who might access patient data.

How should dental PHI be protected?

Protecting dental PHI (Protected Health Information) is essential for maintaining HIPAA dental compliance and ensuring patient trust. Dental offices must implement strong administrative, physical, and technical safeguards to protect both paper and electronic health records (ePHI dental records). This means controlling who can access patient data, training staff on privacy protocols, and creating clear policies on how PHI can be used and disclosed.

For electronic records, dentists should use encrypted systems, secure passwords, and two-factor authentication to prevent unauthorized access. Regular security risk assessments help identify and address vulnerabilities. It's also critical to store paper records in locked areas that are only accessible to authorized staff, and to properly shred documents when disposing of them.

When working with third-party vendors or service providers who may access dental office PHI, always have a signed dental BAA (Business Associate Agreement) in place. This agreement ensures that your partners also follow HIPAA security dental requirements and protect patient privacy dentists are trusted to uphold. By following these steps, dental offices can confidently safeguard sensitive patient information and stay compliant.

Do dentists need BAAs?

Yes, dentists absolutely need Business Associate Agreements (BAAs) to maintain HIPAA dental compliance. A dental BAA is a mandatory contract between your dental office and any third-party service provider (business associate) that handles, processes, or accesses dental office PHI or ePHI dental records on your behalf.

Common examples include dental software vendors, cloud storage providers, billing companies, or IT support teams. These agreements ensure your partners follow the same strict HIPAA security dental standards to protect patient privacy dentists rely on, preventing unauthorized use or disclosure of sensitive information.

Without a proper BAA in place, your practice could face serious penalties—even if the breach of dental office PHI happens on the business associate’s end. Always ensure a signed BAA exists before sharing any PHI or ePHI dental records with outside vendors. This is a fundamental step in safeguarding your patients’ privacy and maintaining compliance.