Complete Guide: HIPAA NPP for Dental Practices

Everything a dental practice — solo dentist, group practice, or DSO-affiliated office — needs to know about the Notice of Privacy Practices requirement.

By NPP Generator Research Team  ·  Published Mar 10, 2026  ·  Last reviewed Apr 23, 2026

Is a dental practice a HIPAA covered entity?

Yes if you transmit any of nine standard transactions electronically. For dental practices, the most common is insurance claims — which virtually every dental office submits electronically now. Dental Medicare/Medicaid participation is a second trigger. A pure fee-for-service cash practice that never submits claims electronically is not a covered entity.

Solo practice structure

The practice entity — the P.C. or P.L.L.C. — is the covered entity. The individual dentist is not separately a covered entity (except as the sole representative of the practice). Your NPP lists the practice entity as the organization, the Privacy Officer (often the dentist or office manager), and practice address.

Group practice structure

A multi-dentist group practice is a single covered entity. One NPP covers all dentists who practice at the group. Each location of a multi-site group should post the NPP separately, but the content is the same.

DSO-affiliated offices

Dental Service Organization (DSO) arrangements vary, but the typical structure:

• Clinical P.C. — the covered entity that treats patients and produces the NPP
• DSO management company — usually a business associate providing administrative, billing, IT, HR services to the clinical P.C.
• BAA between the two — required if the DSO touches PHI on behalf of the clinical P.C.

Common dental business associates

These vendors process PHI on behalf of the dental practice and require a BAA (separate from the NPP): practice management software (Dentrix, Eaglesoft, Open Dental), dental imaging/PACS systems, cloud backup, claims clearinghouses, IT support, outsourced billing, appointment-reminder platforms. Your NPP tells patients about these categories of disclosure in the "uses and disclosures for operations" section.

Distribution

• At first visit: hand the NPP to the new patient; obtain signed acknowledgment (or document refusal)
• Waiting room: post a copy in a prominent place
• Website: post on your practice website
• On request: provide a paper copy to anyone who asks

First-time question? See if your practice actually needs an NPP: Does my practice need a Notice of Privacy Practices? →