HIPAA Compliance Guide for Medical-Dental Integration Programs

When does HIPAA apply to medical and dental providers?

HIPAA applies to health plans, health care clearinghouses, and health care providers that conduct certain standard transactions electronically. Dentists and other health care providers are covered entities when they transmit health information electronically in connection with a transaction for which HHS has adopted a standard. A provider may also conduct the transaction through a billing service or another third party. Sending email by itself does not make a provider a HIPAA covered entity. See HHS guidance on covered entities.

Protected health information (PHI) is individually identifiable health information held or transmitted by a covered entity or business associate, subject to HIPAA’s definitions and exceptions. In an integration program, identify which participating practices and organizations are covered entities, which may be business associates, and what information each handles. Apply any other privacy laws and organizational policies that may also govern the records.

How can providers share PHI for treatment and care coordination?

Covered entities may generally use or disclose PHI for treatment without obtaining the patient’s authorization. This can include consultation between a medical provider and a dental provider involved in the patient’s care, such as sharing relevant medication, allergy, or treatment information. HIPAA does not require a special authorization just because the treating providers work in different practices. HHS explains treatment disclosures and related rules.

Before sharing, verify that the recipient is an appropriate care provider, use a reliable delivery method, and follow applicable state law and organizational procedures. Some information has additional protections: for example, most uses and disclosures of psychotherapy notes require authorization, subject to limited exceptions. A consent process may also be required by state law, a program’s policies, or circumstances outside HIPAA’s treatment-disclosure permission.

When does the minimum necessary standard apply?

The minimum necessary standard generally requires covered entities to make reasonable efforts to limit PHI used, disclosed, or requested for many purposes—such as payment and health care operations—to what is needed for that purpose. It does not apply to disclosures to, or requests by, a health care provider for treatment purposes. HHS lists the standard’s scope and exceptions.

This treatment exception does not mean every workforce member should have unrestricted access to every record. Use role-based access and internal policies so staff can see information appropriate to their job. For non-treatment disclosures covered by the standard, define procedures for routine requests and assess non-routine requests individually.

What safeguards protect medical and dental records?

Use administrative, technical, and physical safeguards to protect PHI and electronic protected health information (ePHI). The HIPAA Privacy Rule requires appropriate safeguards for PHI; the Security Rule requires covered entities and business associates to protect ePHI’s confidentiality, integrity, and availability. HHS summarizes the Security Rule’s requirements.

• Administrative safeguards: assess security risks, assign security responsibilities, manage workforce access, train staff, and prepare to respond to security incidents.
• Technical safeguards: use appropriate access controls, authentication, audit controls, integrity protections, and transmission security.
• Physical safeguards: protect facilities, workstations, devices, and media from unauthorized access, loss, or damage.

The specific measures should reflect the organization’s risk analysis and operating environment. For example, an integration program can establish secure transmission procedures, confirm recipient details before sending records, and define how staff report a misdirected fax or email. See HHS guidance on physical safeguards.

What should business associate agreements cover?

A business associate is generally an outside person or organization that performs certain functions or services for a covered entity involving PHI. A vendor’s access to information alone does not settle its status; assess whether it performs a covered function or service on behalf of the entity and whether a regulatory exception applies. When an organization engages a business associate, a written business associate agreement (BAA) or other arrangement must establish the required protections.

A BAA should describe permitted and required uses and disclosures, require appropriate safeguards, set out breach and incident reporting, address individual rights requests when relevant, and require applicable protections to flow down to subcontractors. It should also address return or destruction of PHI when the relationship ends, when feasible, and other required terms. HHS describes business associate requirements and provides sample BAA provisions.

How can standardized referral documents support record exchange?

Standardized dental referral and consultation documents can make medical-dental coordination clearer by prompting staff to include information relevant to the referral, such as the reason for consultation, relevant history, current medications, allergies, findings, and the question for the receiving provider. Agree on a consistent process for confirming the patient’s identity, recipient, attachments, and follow-up responsibilities.

HIPAA does not generally require providers to use a particular clinical referral form for treatment record exchange. Do not confuse a clinical referral document with the HIPAA standard electronic referral certification and authorization transaction, which concerns a provider’s request to a health plan for authorization to refer or provide care. CMS describes the standardized referral certification and authorization transaction. Regardless of form, use a secure transmission method and follow applicable privacy rules and organizational procedures.

How should programs train and monitor their workforce?

Train workforce members on the organization’s privacy policies and procedures in a way that is appropriate to their roles. HIPAA requires training for workforce members as necessary and appropriate to perform their functions; new workforce members must be trained within a reasonable period, and affected staff must be trained within a reasonable period after a material policy change. The Security Rule also requires a security awareness and training program. HHS summarizes Privacy Rule training duties.

Training should cover practical workflows: which records may be shared for treatment, how to use referral documents, how to verify recipients, how to protect paper and electronic records, and how to report suspected incidents. Document completed training and reinforce policies when workflows or risks change. HIPAA does not impose a universal annual certificate-renewal requirement; a training completion certificate is not proof that an organization is HIPAA compliant.

Monitor whether safeguards and procedures work in practice. Review access and incident reports, address inappropriate access or disclosures, and periodically evaluate security measures against identified risks. A coordinated program depends on clear treatment-sharing workflows, role-appropriate access, suitable safeguards, and agreements that define each party’s responsibilities.

FAQs

Do providers need patient authorization to share information for treatment?

Generally, no. HIPAA permits covered entities to disclose PHI to another health care provider for treatment without the patient’s authorization. Exceptions and additional requirements may apply to certain records, state laws, or circumstances, so providers should follow applicable rules and policies.

Does the minimum necessary standard apply to treatment disclosures?

No. The minimum necessary standard does not apply to disclosures to, or requests by, a health care provider for treatment purposes. Organizations should still follow role-based access policies and other safeguards that protect PHI.

When is a dental practice considered a HIPAA covered entity?

A dental practice is generally a covered entity if it is a health care provider that transmits health information electronically in connection with a HIPAA standard transaction, such as certain claims or referral authorization transactions. Using email alone does not make a practice a covered entity.

What responsibilities do business associate agreements establish?

A BAA establishes the business associate’s permitted and required uses and disclosures of PHI, safeguards, incident reporting duties, applicable assistance with individual rights, subcontractor protections, and return or destruction of PHI when the relationship ends, when feasible. It must include the terms required by HIPAA and reflect the services being provided.