HIPAA Reality Check: What Every Dental Practice Must Know Before Using Any AI Tool
A practical compliance guide for dental practices exploring AI. Covers BAA requirements, PHI definitions, risk scenarios, and questions every practice should ask vendors.
I went in for a routine dental cleaning a few weeks ago on a Friday afternoon. It was the day before a three-day weekend, and the office was only taking a handful of appointments that had been booked months earlier. Mine was one of them.
When the hygienist finished, I asked my dentist if he had a few minutes. We sat in his office, and with very clean teeth, I started asking how his practice was thinking about AI.
His answer surprised me. He was exploring it seriously, doing research on his own in the evenings after the office closed. He knew enough to avoid the obvious traps. Pasting patient notes into a free AI chatbot to clean up the language? He’d already ruled that out. What interested him was something more specific: an AI-powered phone system that could pick up calls when his front office staff were busy with patients standing at the desk. Not a replacement for his team. A backup for the moments when every line was already ringing.
His instinct was exactly right. And the fact that he was being this careful told me something about where dental practices are right now. Interested in AI. Cautious about the risks. Mostly unsure about where the compliance lines actually fall.
This post is for every practice in that position.
Why This Matters Right Now
About one in three dentists now uses at least one AI-powered tool, according to a 2026 survey of 300 practitioners conducted by Dental Reviewed. Another 38% said they were actively considering adoption. The marketing push hitting dental practices is aggressive. Diagnostic imaging and clinical note generation are the two biggest categories right now. Patient communication tools and insurance claims processors are close behind.
Dental practices are covered entities under HIPAA. That’s been true for years, and it doesn’t change because a vendor puts the word “AI” on the product page. Any vendor that handles protected health information on behalf of the practice is generally a business associate under HIPAA, and most AI tools worth using in a dental setting will touch Protected Health Information (PHI) in some form.
Vendors love phrases like “HIPAA-eligible” and “HIPAA-compliant” on their websites. Those phrases mean less than most practice owners assume. A platform can be configured to meet HIPAA requirements and still leave you exposed if the legal agreement underneath it is missing or incomplete.
HHS has made this an enforcement priority. The Office for Civil Rights collected over $15 million in HIPAA fines across 2024 and 2025, according to an analysis published by Censinet. Risk analysis failures and business associate oversight were the recurring themes. Small providers and their vendors appeared alongside large hospital systems in those actions. Size isn’t a shield.
30+ years of research strategy on projects for Oracle, Cisco, PayPal, and Walmart — now helping small businesses adopt AI that actually delivers.
More about George →Keep reading
How AI pricing works, why costs vary so dramatically, and five levers any business owner can pull to spend less without doing less. No technical background required.
Galyx.com: AI Guidance for Small Business. AI isn't just for companies with big budgets. It takes away mundane tasks so you can spend your time on your business.
AI tools are the new calculator. The question isn’t whether you used one. It’s whether you stand behind the work. A practical reframe for business owners.