A Dentist’s Guide to the Law. American Dental Association

setbacks and limits in building height are features that may be determined by local code.

      State and local requirements may impose more stringent requirements and even stronger penalties for non-compliance. However, compliance with such state and local requirements alone will not necessarily ensure compliance with the federal Americans with Disabilities Act, since the federal Act may address issues not covered by state or local laws.

      28. Does HIPAA Impose Requirements Related to Dental Office Design?

      HIPAA does not mandate specific office design features, but the HIPAA rules do require covered entities to have reasonable and appropriate physical safeguards to protect the privacy and security of patient information. Facility security and contingency planning are two areas of the HIPAA Security Rule that may influence dental office design decisions.

      For example, HIPAA requires a covered dental practice to adopt reasonable and appropriate policies and procedures to protect patient information and related buildings and equipment from natural and environmental hazards and from unauthorized access. Some of HIPAA’s physical security safeguard standards can be adjusted according to factors such as the dental practice’s size, complexity, capabilities, and budget.

      The HIPAA Privacy Rule requires covered dental practices to reasonably safeguard patient information to limit incidental uses or disclosures made pursuant to an otherwise permitted or required use or disclosure. In some covered dental practices, such reasonable safeguards may involve dental office design decisions. According to the Office for Civil Rights, “[t]he HIPAA Privacy Rule does not require that all risk of incidental use or disclosure be eliminated to satisfy its standards. Rather, the Rule requires only that covered entities implement reasonable safeguards to limit incidental uses or disclosures.”³

      Dentists who are covered by HIPAA probably do not need expensive structural changes such as private, walled-off operatories or overall office soundproofing. However, dentists should evaluate their office designs under applicable federal and state privacy laws to determine which safeguards are required, how to protect patient information in compliance with the law, and which office design choices are reasonable and appropriate to protect the privacy and security of patient information.

       Office design features that can help protect privacy and security include:

      • Exterior locks on doors and windows

      • Locks on nonpublic areas of the dental office

      • Workstations that cannot be viewed or accessed by the public

      • Secured entrances to areas where patient information is stored

      • Consultation areas and operatories where patient information can be discussed without being overheard

      • Secure disposal of electronic and paper patient information in accordance with a document retention system that meets applicable federal and state law

      • Secure data backup and storage systems

      Although HIPAA does not mandate specific dental office design features, HIPAA compliance considerations may influence dental office design trends over time. For example, offices with open operatories may incorporate curtains or sliding doors. Floor plans may help prevent unauthorized access to patient information (for example, floor plans that direct foot traffic flow away from areas where patient information may be accessed, such as the front desk). Products marketed to protect and secure patient information (such as easily locking cabinets) may become more prevalent. While some of these changes may not be specifically required by HIPAA, they may make good compliance sense for both HIPAA and state privacy laws, so they are likely to take root in designers’ thinking about dental office design.

      Unauthorized access to patient information can result in reputational and financial harm to the patient; for example, if a Social Security number is stolen, or if patient information is disclosed to an unauthorized individual. Unauthorized use or disclosure of patient information can also cause reputational harm to a dental practice, as well as the financial burden of complying with breach notification laws and the risk of penalties for noncompliance. Keeping privacy and security in mind when designing a dental office can help protect both patients and the dental practice.

      Related References and Resources

      • Chapter 15: HIPAA, State Law and PCIDSS: Patient Information

      • HIPAA 20 Questions

      ADA.org/DentistGuidetoLaw

      • OCR Frequently Asked Questions: Is a Covered Entity Required to Prevent Any Incidental Use or Disclosure of Protected Health Information?

      www.hhs.gov/ocr/privacy/hipaa/faq/incidential_uses_and_disclosures/206.html

      • The ADA Practical Guide to HIPAA Compliance: Privacy and Security Manual

      adacatalog.org or 1.800.947.4746

      29. Will Other Cutting Edge Dental Issues Affect Office Design?

      A number of other laws and considerations affecting dental practice have the potential to significantly impact dental office design.

      Ergonomics

      If and when a federal ergonomics standard is passed, it may dramatically affect dental office design. It may be good risk management to proactively address ergonomics issues in your office design even though there are no current federal legal requirements. Considerations may include adequacy of space, placement of equipment, and four-handed dentistry.

      Waste Management

      Concerns about waste management may also affect office design. Some waste products that have come under regulatory scrutiny include X-ray fixer and developer; mercury/amalgam in wastewater; solid medical waste (including sharps); and various pharmaceuticals and other chemical substances classified as hazardous or controlled medical wastes. For example, space must be provided for segregating regulated medical waste from other solid waste. Thought should be given to how you will remove mercury/amalgam from the office wastewater. For example, do you have adequate space to install and maintain an amalgam separator. Also, convenient access to plumbing and clean-out points for plumbing can be designed into new construction.

      Regulated Drugs

      Space design should consider the need to maintain certain classes of drugs in a secure location. Other materials and equipment may also be of value and require a secure storage location. Properly locked cabinets should be included in office design.

      Related References and Resources

      • Question 70: What if I Suspect an Employee or Co-Worker Is Abusing or Taking Drugs from the Dental Office?

      • ADA Statement on Best Management Practices for Amalgam Waste (includes a Practical Guide to Integrating BMPs Into Your Practice) ADA.org/en/member-center/oral-health-topics/amalgam-waste-best-management

      30. Is Video Surveillance Permitted in the Dental Office?

      A number of complex federal and state laws regulate workplace surveillance, and a variety of factors may influence the legal risks associated with surveillance activities. For example, before a dental practice implements a surveillance program,