Medical and Dental Offices and What HIPAA Asks of a Contractor
Why this matters
A tech who walks into a dental office to fix a condensate pump will see patient names before reaching the equipment: on the sign-in clipboard, on the front desk monitor, on the schedule taped inside the sterilization room door. Most shops either panic about HIPAA and sign paperwork they do not need, or ignore it and let a tech post a job photo with a patient's chart in the background. Both are mistakes, and the second one is the kind a practice remembers when the service contract comes up for renewal. The actual rule is narrower than the fear and stricter than the indifference.
Who HIPAA actually reaches
HIPAA, the federal Health Insurance Portability and Accountability Act, and its Privacy Rule bind two kinds of party directly.
- A covered entity is a health plan, a clearinghouse, or a health care provider that bills electronically. Nearly every medical and dental office you will enter is one.
- A business associate is a person or company that performs a function or service for a covered entity that involves creating, receiving, keeping or transmitting protected health information (PHI), meaning health information tied to an identifiable person. The definition sits at 45 CFR 160.103.
The test is whether your service involves patient information, not whether you might glimpse some. The federal Department of Health and Human Services (HHS) has said in its published guidance that people whose work does not involve PHI, and whose access to it is incidental if it happens at all, are not business associates, and it gives janitorial services and electricians as examples. A plumber replacing a sterilizer drain, an HVAC tech changing a blower motor, a garage door tech on the loading door, a pest tech running the perimeter: none of that work uses patient information, so none of it makes the shop a business associate.
Where the answer flips. Some trade-adjacent work genuinely does involve PHI, and then a business associate agreement (BAA) is the correct paperwork:
- low-voltage or IT work on the server, the imaging computer, the network or the phone system where you can reach stored records or voicemail;
- hauling away old computers, hard drives, X-ray films or paper charts;
- any service where you take records off site, even for a day.
If your shop does any of that, the practice is right to ask for a BAA, and you need one before the work, not after.
Incidental is permitted; looking is not
The Privacy Rule (45 CFR 164.502) permits incidental uses and disclosures, the unavoidable byproduct of an otherwise permitted activity, as long as the practice has reasonable safeguards in place. A name visible on a monitor while you walk to the mechanical closet is incidental. That rule protects the practice. It does not license you to do anything with what you saw.
So the working standard for a tech is three verbs:
- Do not read. If a chart, screen or tray card is in front of you, look at the equipment, not the paper. Do not turn a page, wake a sleeping monitor, or pick up a folder to move it. Ask staff to move it.
- Do not photograph. A job photo is a copy of whatever is in the frame. It lands on a phone that syncs to a cloud, then in your job record, then possibly in a customer email. A recognizable patient, a name on a screen or a label on a model is in every one of those places now.
- Do not repeat. Seeing that your kid's teacher was in the chair at 10:15 is incidental. Mentioning it at dinner is a disclosure, and it will get back to the practice.
None of these are HIPAA duties on you as a non-associate. They are what keeps the practice inside the incidental rule, and the practice will judge your shop on it. This is not legal advice; if a practice hands you a contract with privacy terms in it, that is a question for your own attorney.
Where PHI sits in an office, room by room
| Room | What is in view | What the tech does |
|---|---|---|
| Waiting room | Sign-in sheet, patients themselves | Do not read the sheet; do not greet a patient by name unless they greet you first |
| Front desk | Schedule on monitors, insurance cards, the phone | Work behind the desk only when staff can lock screens; do not answer the phone |
| Operatory or exam room | Chart on the screen, X-rays on the viewer, a patient in the chair | Enter only between patients, after the screen is cleared |
| Sterilization and lab | Case pans and lab boxes labeled with patient names | Turn labels away or ask staff to; keep them out of photos |
| Records room or server closet | Paper charts, the server | This is where the work may become business-associate work; stop and ask |
| Break room | Schedules, notes on the fridge | Same as front desk |
| Trash and shredder bins | Discarded paper with names | Never move or empty them as part of your cleanup |
The operatory is the room that most changes how you plan the day. See related: How to Work in a Dental Operatory Between Patients for the procedure, and What Infection Control Asks of a Trade in a Healthcare Space for dust, barriers and surfaces. This card stays on information.
Photos: the single biggest exposure a shop creates
Field-service shops photograph everything: the nameplate, the failed part, the repaired work, the area before you started. In an ordinary home that is good practice. In a practice it is the most common way a contractor creates a real disclosure, because nobody looks at the background.
The rule that works: frame the equipment, then check the whole frame before you save it. Specifically look for monitors, the edges of paper on counters, wall-mounted X-ray viewers, a patient's reflection in a glass door, and the label on a lab box. If any appear, delete the photo on the spot and retake it from a tighter angle. Do not keep it and crop later; the uncropped original has already synced.
Two more points that shops miss:
- Deleted on the phone is not deleted. Many phones keep a recently deleted folder for weeks, and a shared photo library or a cloud backup may already have the file. Empty the recently deleted folder for that photo the same day.
- Video is worse. A walk-through video for a quote sweeps past every screen in the hallway. If you need one, ask the office manager to walk ahead and lock screens, or shoot it after hours with the lights off in the front office.
Worked example: a ceiling fan coil above the front desk
A dental office with four operatories calls about a dripping fan coil unit above the front desk. The office manager books the visit for 11:30 on a weekday, during patient hours, because the drip is landing near the scheduling computer.
Arrival, 11:30. The waiting room has three patients. The sign-in clipboard is on the counter facing out. The tech walks past it without reading it and asks for the office manager, not for "whoever called about the leak," because the front desk is talking to a patient about a balance.
The work zone. The fan coil is directly above two front desk workstations. Both monitors show the day's schedule, 26 appointment rows across four operatories. The tech asks the manager to move the two front desk staff to the spare workstation in the back office for 40 minutes and to lock both screens. The manager agrees to lock one and leave the other on so the second staff member can still check patients out from it. The tech's answer: turn that monitor away from the ladder, because from the top step you can read it. The manager angles it toward the wall.
Photos. The tech takes six photos: the unit label, the clogged condensate trap, the stained ceiling tile, the drain line, the cleared trap, and the reinstalled tile. Reviewing them on the ladder, two of the six show the edge of the second monitor, and one of those two has a readable patient name and appointment time. The tech deletes both, retakes them looking straight up into the plenum, and empties the recently deleted folder before climbing down. Six photos go into the job record, none showing a screen.
A drop of water on a chart. While the tech is cleaning up, the manager mentions that a paper chart on the counter got wet earlier. The tech does not pick it up to check. It is the practice's record and the practice's call.
The invoice and notes. The job notes read "cleared condensate trap at front desk fan coil; replaced one stained ceiling tile." No patient names, no "the patient in op 2 complained about the noise," no reference to anyone the tech recognized. The tech did recognize a neighbor in the waiting room. That fact goes nowhere: not into the notes, not into conversation with the neighbor, not into the van ride back.
Total time on site: about 55 minutes, 40 of them in the work zone. The privacy measures added maybe 10 minutes, mostly the photo review and the retakes.
What would have changed the plan. If the drip had been in the server closet instead of over the front desk, the tech would still be doing HVAC work and still not be a business associate, but the closet is where unshredded records and the server live. The tech would ask for staff to be present the whole time and would not touch anything but the unit. If the practice had asked the tech to also unplug and move the server to protect it from the water, that is still not using PHI, but it moves the tech from incidental exposure to handling the record system, which is where a shop that does not hold a BAA should decline and let the practice's IT vendor do it.
When the practice hands you a business associate agreement anyway
Many offices send every vendor the same packet, including a BAA, because their compliance consultant told them to. You have three reasonable responses:
- Explain politely that your work does not involve patient information and offer a confidentiality acknowledgment instead: you will not read, copy, photograph or disclose anything you encounter, and you will report to them if you think you did.
- Sign it if the terms are ones your shop can actually meet. A BAA carries real duties: safeguards, breach reporting, flowing terms down to subcontractors. Signing one you cannot honor creates a contract obligation you will break.
- Send it to your attorney if it includes indemnity, insurance requirements or breach-cost terms. That is a contract question, and it is not one to answer at the front desk.
State law can reach further than HIPAA
HIPAA is a federal floor. Some states define who must protect health information more broadly; Texas, for example, applies its medical records privacy law to a wider set of people than the federal definition of a covered entity. Other states layer their own breach notification and medical confidentiality statutes on top. If your shop works in medical offices regularly, read your own state's medical privacy statute once, or ask your attorney what it adds. Do not assume the federal incidental-exposure position is the whole answer in every state.
How to verify a tech is doing this right
Pull the last five medical or dental job records and check three things:
- Photos: zero frames showing a screen, a chart, a label with a name, or a person. One is a training conversation; a pattern is a process problem.
- Notes: no patient names, no room-plus-time references ("op 3 at 10:00") that identify a patient to anyone with the schedule.
- The office manager's view: on the next visit, ask whether the tech asked before moving anything with paper on it. Office managers notice, and a yes is the answer you want.
References
- 45 CFR 160.103, definitions of covered entity and business associate (HHS)
- 45 CFR 164.502, uses and disclosures of PHI, including incidental uses and disclosures
- HHS Office for Civil Rights guidance on business associates and incidental uses and disclosures
- See related: What Infection Control Asks of a Trade in a Healthcare Space
- See related: How to Work in a Dental Operatory Between Patients; The Medical and Dental Office Visit SOP