For years, dental practices operated under an unspoken assumption: HIPAA enforcement focused on hospitals and large health systems, not small practices. That era is definitively over. The HHS Office for Civil Rights (OCR) settled 15 cases against dental practices in 2025 alone—more than the previous five years combined.

The average settlement: $1.2 million. The most common violation: failure to conduct required risk assessments. Many practice owners are shocked to learn that simply having EHR software doesn't constitute HIPAA compliance.

What's Changing in 2025

The proposed HIPAA Security Rule updates, expected to be finalized by Q2 2025, introduce several new requirements. Most significantly: mandatory encryption of all electronic PHI (currently "addressable" meaning optional with documentation), annual penetration testing for practices with 10+ employees, and 72-hour breach notification timelines.

Perhaps most impactful is the new "recognized security practices" provision. Practices that can demonstrate implementation of frameworks like NIST or HITRUST will receive favorable consideration during audits. Those without documented security programs face presumptive penalties.

The Risk Assessment Requirement

Every HIPAA-covered entity must conduct an annual risk assessment. Yet OCR investigations consistently find that 70%+ of dental practices have never completed one or cannot locate documentation from previous years.

A proper risk assessment isn't a checkbox exercise. It must identify all systems containing PHI, evaluate threats and vulnerabilities, assess current security measures, and document residual risks with remediation plans. Using a template isn't sufficient if you can't demonstrate the analysis was thorough and specific to your practice.

Consider engaging a qualified third party for your first assessment. The $2,000-5,000 investment provides defensible documentation and identifies gaps you may not recognize. DIY assessments are acceptable but require meticulous documentation.

Business Associate Agreements: The Hidden Liability

Your practice is liable for PHI breaches by vendors—dental labs, billing services, cloud backup providers, even your IT support company. Business Associate Agreements (BAAs) are required for every vendor with PHI access, and those agreements must be current.

OCR is increasingly pursuing practices for failures to obtain BAAs or monitor vendor compliance. Review your vendor list: does your credit card processor have a BAA? Your patient communication platform? Your appointment reminder service? If they access patient names, phone numbers, or appointment details, they're handling PHI.

Action Items for 2025

First, schedule your annual risk assessment before March. Document everything—the date, participants, methodology, findings, and remediation timeline. Second, audit your BAAs and ensure all vendors are covered. Third, implement or upgrade encryption for all devices storing PHI, including that laptop the front desk uses for insurance verification.

Finally, train your team. Annual HIPAA training is required, but quarterly refreshers on specific topics—phishing recognition, proper disposal, access controls—create a culture of compliance that protects your practice when incidents occur.

The cost of HIPAA compliance is a fraction of a single enforcement action. More importantly, your patients trust you with sensitive information. Meeting that obligation is simply good medicine.