Dental HIPAA Privacy and PHI Handling SOP

Standard procedure for protecting patient PHI in a dental practice, including dental records, imaging, lab prescriptions, screen privacy, access control, and secure handling of disclosures.

Steps

• Clinical staff member verifies role-based access before opening PHI
  The clinical staff member confirms their account is assigned to the minimum necessary access level for the task and opens only the patient record required to complete the work.
• Clinical staff member opens only the minimum necessary patient record
  The clinical staff member opens only the chart, imaging, or billing record needed for the current work activity and closes any unrelated patient records before continuing.
• Clinical staff member confirms screen privacy in patient-facing areas
  The clinical staff member positions the monitor so PHI is not readable from adjacent workstations or public viewing angles and confirms no patient data is visible from more than 3 feet away.
• Clinical staff member securely handles dental images and scans
  The clinical staff member stores, transmits, and displays radiographs, intraoral photos, and scans only through approved secure systems and confirms the files remain encrypted or otherwise protected within those systems.
• Treatment coordinator prepares lab prescriptions and referrals with minimum necessary PHI
  The treatment coordinator includes only the PHI needed for the lab or referral to complete the order and removes extraneous clinical or demographic details before sending it through an approved transmission method.
• Front desk staff member prints PHI only to secure output devices
  The front desk staff member sends PHI only to a secure printer or locked print release queue and retrieves the pages immediately after release so no printout remains unattended.
• Office staff member disposes of PHI using approved secure methods
  The office staff member places paper records, labels, and other discarded PHI into the shred bin or secure disposal container instead of regular trash or recycling.
• Practice manager escalates suspected privacy incidents immediately
  The practice manager reports lost records, misdirected faxes, unauthorized viewing, or accidental disclosure to the designated privacy or compliance lead without delay and documents the incident for follow-up.