Free download · Dental practices
Dental Office Compliance Checklist (Free PDF)
OSHA, infection control, HIPAA, and the licenses-and-logs calendar — the whole compliance picture for a dental practice, on two pages.
Dental compliance isn't one program, it's four — OSHA's workplace rules, the CDC's infection-control expectations, HIPAA's privacy and security requirements, and a drawer full of registrations and logs with renewal dates. The practices that stay out of trouble aren't the ones working hardest in inspection week; they're the ones where each item has a name, a frequency, and a dated log. Inspectors rarely ask whether you did something — they ask to see the record that you did.
This checklist puts all four programs on two pages, with the five findings we see most often in real practices.
We ask for your first name and email, then the PDF downloads right here.
What's inside
OSHA essentials — the Exposure Control Plan, hep B vaccination, annual training records, sharps log, hazard communication, PPE, the eyewash station
Infection control — weekly spore testing, one-way instrument flow, waterline testing, surface protocols, and the named coordinator
HIPAA & IT — the Security Risk Assessment, BAAs, unique logins with MFA, encrypted devices and tested backups, training and same-day offboarding
Licenses, equipment & records — x-ray registration (IEMA in Illinois), DEA, license and CE tracking, medical waste manifests, the amalgam separator, emergency equipment, records retention
The compliance calendar — what's weekly, monthly, and annual, so it's routine instead of a scramble
The five findings we see most in dental offices
The checklist
1. OSHA essentials — what inspectors ask for first
Written Exposure Control Plan. Site-specific bloodborne pathogens plan — reviewed, updated, and dated annually, not a binder from the practice's opening year.
Hepatitis B vaccination offered. Free to clinical staff within 10 days of hire; signed declination forms on file for anyone who passes.
Annual training with records. Bloodborne pathogens at hire and annually — dates, content, and signatures retained.
Sharps discipline. Approved containers, never overfilled, and a sharps injury log that's actually maintained.
Hazard communication. An SDS for every chemical in the building, secondary containers labeled, staff trained on the system.
PPE at employer expense. Gloves, masks, eyewear, gowns — provided, accessible, and actually worn.
Eyewash station that works. Plumbed and ANSI-compliant, activated weekly (logged), and unobstructed.
Posters and injury reporting. The OSHA poster displayed; work injuries recorded and reported on the required timelines.
2. Infection control — CDC guidelines, in practice
Weekly spore testing, logged. Biological monitoring of every sterilizer, results recorded and retained — the log's vacation-week gaps are the classic finding.
One-way instrument flow. Dirty to clean, no crossing back; packages dated and initialed so a failed load can be recalled.
Waterlines treated and tested. Dental unit water maintained and periodically tested to the ≤500 CFU/mL standard; documented shock treatment when a line fails.
Surface disinfection protocol. EPA-registered products with their contact times honored; barriers where they make more sense.
A named infection control coordinator. One person owns the program, the logs, and the annual review.
Make it a calendar, not a scramble: weekly (spore test, eyewash activation), monthly (emergency kit and oxygen check), annually (OSHA training, Exposure Control Plan review, HIPAA risk assessment, license audit). Assign each line a name and a month.
3. HIPAA & IT — the five that decide an audit
Security Risk Assessment in the last 12 months. Documented, with a remediation plan — the single most-cited gap in HIPAA enforcement.
BAAs with every PHI vendor. Practice management, imaging, IT provider, email, claims clearinghouse, shredding — signed and filed.
Unique logins and MFA. No shared front-desk or operatory accounts; MFA on email and anything reachable from home.
Encrypted devices, tested backups. Workstations and laptops encrypted; backups with an offsite or immutable copy — and a documented test restore.
Training logged, offboarding same-day. HIPAA training records kept six years; departing staff lose PMS and email access on their last day.
The full IT detail lives in our HIPAA Compliance Checklist — grab both.
4. Licenses, equipment & records — the renewal calendar
X-ray registration current. Units registered and inspected per your state (IEMA in Illinois) — re-checked after any equipment swap, which is where lapses happen.
DEA and controlled substances. Registrations current, secure storage, logs kept to schedule.
Licenses and CE tracked. Dentist, hygienist, and assistant renewals plus CE hours — with reminders set before, not after.
Medical waste under contract. A licensed hauler, with manifests retained.
Amalgam separator maintained. Installed, serviced, and documented per the EPA dental rule.
Emergency equipment in date. Oxygen, emergency kit medications, and the AED — checked monthly, and logged.
Records retention and disposal. Patient records kept to your state's minimums, then destroyed securely — with certificates.
The five findings we see most in dental offices
1. Spore-test log gaps — vacation weeks tell on you
2. No documented HIPAA risk assessment, or one from years ago
3. Shared logins at the front desk and in operatories
4. An SDS binder that predates half the products in the building
5. X-ray registration lapsed after an equipment upgrade
Dental compliance FAQ
What compliance requirements apply to a dental office?
Four overlapping programs: OSHA (bloodborne pathogens, hazard communication, workplace safety), CDC infection-control guidelines (sterilization monitoring, waterlines, surface protocols), HIPAA (privacy, security, and breach rules for patient data), and state-level registrations — x-ray equipment, professional licenses, controlled substances, waste handling. Each one is manageable; the risk is that no one person sees all four.
How often does a dental office need to spore test?
Weekly biological monitoring of each sterilizer is the CDC's recommendation and the standard inspectors expect, with results logged and retained. The most common finding isn't a failed test — it's gaps in the log from weeks when the person who usually runs it was out.
Does HIPAA really apply to small dental practices?
Yes — any practice that bills electronically is a covered entity regardless of size, and enforcement actions have reached single-location dental offices. The requirements scale down sensibly, though: a named officer, a current risk assessment, BAAs, training records, and the IT basics (unique logins, MFA, encryption, tested backups) cover most of what an audit asks about.
What OSHA records does a dental office need to keep?
The written Exposure Control Plan (reviewed annually), training records with dates and signatures, hepatitis B vaccination or declination forms, the sharps injury log, Safety Data Sheets for chemicals in use, and injury reports. The pattern across all of them: dated paper. If it isn't written down, an inspector treats it as not done.
The IT half of this list is our day job.
Datastrive supports dental and orthodontic practices across Chicagoland — HIPAA-ready dental IT, encrypted backups with proof, and the documentation that makes audits boring. Free dental IT compliance review: we'll walk sections 3 and 4 against your practice and hand you the findings.
Prefer to talk? Call 1-773-863-3868.
More free resources: HIPAA Compliance Checklist · Small Business Cyber Security Checklist · see all free resources
Compiled by Datastrive, IT partner to Chicago-area dental practices. OSHA, CDC, EPA, and state requirements govern — verify specifics with your compliance consultant. Not legal advice.