Does HIPAA apply to dental practices in Florida?

Yes. Dental practices are healthcare providers under HIPAA and are fully subject to its Privacy Rule, Security Rule, and Breach Notification Rule. Any dental practice that transmits health information electronically — including insurance claims, referrals, or eligibility verification — is a covered entity with the same obligations as a physician practice or hospital. Practice size is irrelevant. A solo dentist in Ocala or Gainesville has identical HIPAA compliance obligations to a large dental group.

Are dental X-rays and patient photos considered PHI under HIPAA?

Yes. Panoramic X-rays, bite-wing X-rays, periapical X-rays, intraoral photographs, extraoral photographs, 3D cone beam CT images, and any dental image linked to a patient are Protected Health Information under HIPAA. Storing these images on unsecured servers, transmitting them unencrypted, or sharing them without patient authorization are all HIPAA violations. Dental imaging systems — including digital X-ray software and intraoral camera platforms — require Business Associate Agreements with their vendors and must be included in the practice's risk analysis.

Does Dentrix or Eaglesoft require a HIPAA Business Associate Agreement?

Yes. Dentrix (Henry Schein), Eaglesoft (Patterson Dental), Open Dental, Curve Dental, and every other dental practice management software platform that creates, receives, maintains, or transmits patient PHI requires a signed Business Associate Agreement with the practice before the software is deployed or hosted. Most vendors offer a standard BAA — but it must be actively requested and executed, not assumed. Cloud-hosted versions of these platforms (Curve Dental, Dentrix Ascend) have their BAA built into the service agreement, but practices must confirm it is properly executed.

Can dental practices send appointment reminders via text message under HIPAA?

Yes, with proper patient authorization. Dental practices can send appointment reminders via text message if the patient has provided written authorization acknowledging the risk of unencrypted SMS. Without that authorization, text messages containing the patient's name, appointment date, and dental practice name together constitute PHI and violate HIPAA's transmission security standard. Authorization should be collected at intake, documented in the patient record, and renewed if the patient changes their communication preferences. Automated texting platforms that handle PHI also require a BAA with the platform vendor.

What are the most common HIPAA violations found in Florida dental offices?

The most common HIPAA violations in Florida dental offices are: (1) dental imaging systems without a BAA with the software vendor; (2) patient appointment reminder texts sent without documented patient authorization; (3) front desk staff using personal email to coordinate patient care; (4) shared login credentials in the practice management software; (5) no formal risk analysis that includes the imaging system, payment processing, and patient communication platforms. Dental offices also frequently miss the requirement to include intraoral camera vendors, digital X-ray software vendors, and 3D imaging vendors in their BAA inventory.

← Back to Blog

Compliance

HIPAA Compliance for Dental Practices in North Central Florida — Dentrix, Eaglesoft, and the Risks Your Front Desk Doesn't Know About

June 25, 20268 min readSteve Condit — Founder, Simply IT

Compliance

HIPAA applies to every dental practice in North Central Florida — but most dental-focused HIPAA guidance focuses on medical practices and misses the risks specific to dentistry. Panoramic X-rays, intraoral photos, appointment reminder texts, Dentrix BAAs, and front desk email are not peripheral concerns. They are the exact areas where OCR finds violations in dental offices most often. This guide covers what is different about dental HIPAA, what your practice management software vendor needs from you, and how to close the gaps that put Florida dental practices at risk in 2026.

100%

Dental practices subject to HIPAA regardless of size

43%

Dental offices without a BAA for their imaging system

$1.9M

Max fine per HIPAA violation category per year

Increase in OCR enforcement actions against dental offices since 2022

What Makes Dental HIPAA Different From Medical HIPAA

The Privacy Rule and Security Rule apply identically to dental and medical practices. What differs is the specific technology dental offices use and the PHI those systems generate. A dental practice runs Dentrix or Eaglesoft (not an EHR like Epic or Athena), uses digital X-ray systems and intraoral cameras (not PACS imaging), and communicates with patients primarily through appointment reminders and front desk email. Each of these creates HIPAA obligations that general IT providers and even many dental consultants overlook.

The most important distinction: dental imaging is PHI. Panoramic X-rays, bite-wing series, intraoral photographs, and 3D cone beam CT images are all Protected Health Information once they are linked to a patient record. The software that stores, transmits, and displays those images — your digital X-ray system, your intraoral camera platform, your CBCT software — must be treated with the same HIPAA discipline as your practice management software.

The 5 HIPAA Gaps Specific to Dental Offices in North Central Florida

Missing BAA for the dental imaging system

Your digital X-ray software vendor (Dentsply Sirona, Carestream, Planmeca, Vatech, etc.) handles PHI and requires a signed BAA. Most dental practices have a BAA with their practice management software vendor but nothing for the imaging platform. Dental imaging vendors will execute a BAA on request — most simply do not raise it proactively.

Appointment reminder texts without documented patient authorization

Sending 'Reminder: your appointment at Ocala Family Dental is tomorrow at 10am' to a patient's mobile phone via standard SMS exposes the patient's name and the fact that they are a dental patient. This is PHI under HIPAA. Patient must provide written authorization acknowledging the risk of unencrypted communication before your office sends SMS reminders. Authorization forms should be collected at intake and kept in the patient record.

Front desk staff using personal or shared email for patient coordination

Front desk staff often use a single shared inbox (office@dentalpractice.com) or personal Gmail accounts to coordinate patient care, communicate with insurance companies, and confirm referrals. Shared inboxes fail the unique user ID requirement. Personal email accounts are not covered by any HIPAA-compliant security configuration. Both create significant exposure.

Shared logins in Dentrix, Eaglesoft, or Open Dental

Practice management software must be configured with individual logins per staff member — not a shared username and password for the front desk. Shared credentials fail HIPAA's unique user identification requirement and make it impossible to produce audit logs showing which individual accessed specific patient records.

No annual risk analysis that includes dental-specific systems

A HIPAA risk analysis must enumerate every system that creates, receives, maintains, or transmits PHI. For a dental practice, that list includes the practice management software, the digital X-ray system, the intraoral camera storage platform, the 3D imaging system if present, the patient communication and reminder platform, the payment processing terminal, and any cloud backup service touching patient data. Most practices that have completed a risk analysis did so years ago and have never updated it to include newer systems.

Staff Training in a Dental Office: What HIPAA Actually Requires

HIPAA requires documented security awareness training for every workforce member who has access to PHI — including front desk staff, hygienists, dental assistants, billing staff, and any part-time employees. Training must occur at hire and then at least annually thereafter. A single staff meeting briefing does not satisfy this requirement. OCR expects training completion records with employee names, training dates, and content covered.

For dental offices, the most important training topics are: phishing recognition (front desk staff are the primary target for credential theft attacks against dental offices), proper patient communication authorization (when to use text vs. email vs. mail), handling patient photos and X-rays appropriately, and what to do when a potential breach is suspected. Staff should know to report suspicious emails and incidents immediately rather than deciding on their own whether something is serious enough to escalate.

// Key Takeaway

Dental practices face HIPAA obligations that general IT providers rarely address — imaging system BAAs, patient photo handling, SMS authorization, and practice management software unique logins. Simply IT provides HIPAA-aligned IT services for dental practices across Ocala, Gainesville, and The Villages, including BAA execution with all dental software vendors, imaging system security configuration, staff training documentation, and annual risk analysis support.

Schedule Your Dental Practice HIPAA Assessment →

// Written By

STEVE CONDIT

Founder & Owner, Simply IT · US Marine Veteran · 30+ Years IT Experience

Steve Condit founded Simply IT to bring enterprise-grade IT management to small and mid-sized businesses across North Central Florida. With over 30 years of IT experience and a background in the US Marine Corps, Steve built Simply IT around the principle that local businesses deserve the same quality of technology partnership that large companies take for granted — without long-term contracts or national call center support.

Full Bio →LinkedIn →About Simply IT →