Home › Guides

OSHA and HIPAA Training for Small Medical and Dental Offices

A small medical or dental office usually has four training rules to track: bloodborne pathogens, hazard communication (HazCom), fire safety and HIPAA. OSHA says there are no OSHA standards written just for dentistry, so the general industry standards apply. Each rule has its own timing. Some parts, like walking staff through your own exposure control plan, only the office can do. This guide lists what each rule says, gives a simple training calendar, and explains where Pact's online courses fit and where they don't.

Updated October 24, 2026 · Checked against the official sources listed at the end

There is no separate OSHA rulebook for dental offices

OSHA's dentistry page says there are currently no specific OSHA standards for dentistry. Instead, the hazards found in dental work are covered by OSHA's general industry standards.

OSHA's brochure for medical and dental offices lists the requirements that normally apply to these offices, whether there are two or 200 employees. It names the Bloodborne Pathogens standard, the Hazard Communication standard, the Ionizing Radiation standard for offices with an x-ray machine, the exit route and emergency plan standards, the electrical standards and the OSHA poster. It also says many other standards may apply, so the brochure is a starting point, not the full list.

This guide covers the three OSHA training rules most offices deal with, plus HIPAA.

Bloodborne pathogens training (29 CFR 1910.1030)

OSHA calls this the most frequently requested and referenced OSHA standard affecting medical and dental offices. It applies to employees with occupational exposure, meaning reasonably anticipated contact with blood or other potentially infectious materials from doing their job. The test is the job's duties, not the job title.

An employer with exposed employees must have a written exposure control plan (1910.1030(c)(1)(i)). The plan must be reviewed and updated at least once a year (1910.1030(c)(1)(iv)).

Training rules under 1910.1030(g)(2):

The employer trains each exposed employee at no cost to the employee and during working hours.
Training happens at initial assignment to exposure tasks and at least annually after that, within one year of the last training.
Extra training is due when new or changed tasks affect an employee's exposure.
The content must include the office's own exposure control plan and how to get a copy.
There must be a chance for interactive questions and answers with the person conducting the training.
Training records are kept for 3 years (1910.1030(h)(2)(ii)).

The question-and-answer rule and online courses

In a June 26, 2003 interpretation letter, OSHA said the interactive question rule means employees must have direct access to a qualified trainer during the training session. OSHA said answering emailed questions later does not count unless the trainer is available to answer them when they come up. It also said a qualified trainer must be available even if no one asks a question.

So an online course alone doesn't finish the job under OSHA's reading. The office still needs someone who knows its procedures and is available to answer questions, plus the parts about its own plan, PPE and sharps procedures.

The rule also ties the hepatitis B vaccine to training. The vaccine must be made available after the employee gets the vaccine information in training and within 10 working days of initial assignment, with listed exceptions (1910.1030(f)(2)(i)).

Hazard communication training (29 CFR 1910.1200)

Offices use hazardous chemicals too. OSHA's brochure gives examples such as alcohol, disinfectants, anesthetic agents, sterilants and mercury. It lists the basics: a written hazard communication program, a list of the hazardous chemicals used or stored in the office, a data sheet for each one, and employee training. (The brochure uses the older term MSDS. The current standard says safety data sheet, or SDS.)

Under 1910.1200(h)(1), the employer trains employees at the time of their initial assignment and whenever a new chemical hazard they haven't been trained on comes into their work area. The training section doesn't set a yearly schedule.

Training must include the details of the employer's own program, including its labeling system and how employees can get and use the safety data sheets (1910.1200(h)(3)(iv)). Safety data sheets must be readily accessible to employees during each work shift (1910.1200(g)(8)). Our guide on how to read a safety data sheet is a good companion for this training.

Fire safety: extinguishers and emergency plans

If the office provides portable fire extinguishers for employee use, OSHA requires an educational program on the general principles of extinguisher use and the hazards of fighting a fire in its early stage (1910.157(g)(1)). It is due upon initial employment and at least annually after that (1910.157(g)(2)).

Where an OSHA standard requires an emergency action plan, 1910.38 sets its contents. The plan must be in writing, but an employer with 10 or fewer employees may communicate it orally (1910.38(b)). The employer reviews the plan with each covered employee when the plan is made or the employee is first assigned, when the employee's duties under it change, and when the plan changes (1910.38(f)).

A course can explain how extinguishers work. It can't show your staff where your exits and extinguishers are. That walk-through is the office's job.

HIPAA training (45 CFR 164.530(b))

HIPAA's training rule applies to covered entities. A health care provider is a covered entity if it transmits health information electronically in connection with a transaction covered by the HIPAA rules (45 CFR 160.103). Confirm whether your office meets that definition.

A covered entity must train all members of its workforce on its policies and procedures for protected health information, as needed for their jobs. Workforce includes employees, volunteers and trainees, paid or not (160.103).

HIPAA doesn't set a yearly schedule for this training. It requires training for each new workforce member within a reasonable period after joining, and for staff affected by a material change in policies within a reasonable period after the change. The office must document the training and keep the documentation for six years (164.530(b)(2) and (j)(2)).

The Security Rule adds a separate duty: a security awareness and training program for all workforce members, including management (164.308(a)(5)).

There is no official HIPAA certification. HHS says it does not certify any persons or products as "HIPAA compliant."

A simple training calendar for a small office

At hire: bloodborne pathogens (before exposure tasks), HazCom, extinguisher education (if extinguishers are provided for employee use), emergency plan review, and HIPAA within a reasonable time.
Every year: bloodborne pathogens refresher within one year of the last one, and extinguisher education.
When things change: HazCom when a new chemical hazard arrives; bloodborne pathogens when tasks change exposure; HIPAA when a policy changes materially; emergency plan review when the plan or someone's duties change.
Records: bloodborne pathogens training records for 3 years; HIPAA documentation for 6 years.

Where Pact's online courses fit

Pact sells four online courses from ProTrainings: Healthcare Bloodborne Pathogens ($34.95), HIPAA ($34.95), Workplace Fire Safety ($24.95) and HazCom ($24.95). Healthcare Bloodborne Pathogens is an online certification course from ProTrainings. Confirm with your program or clinical site that this course meets its requirements before you enroll. HIPAA is an online certification course from ProTrainings. Confirm with your program or clinical site that this course meets its requirements before you enroll. Workplace Fire Safety is an online certification course from ProTrainings. Confirm with your program or clinical site that this course meets its requirements before you enroll. HazCom is an online certification course from ProTrainings. Confirm with your program or clinical site that this course meets its requirements before you enroll. ProTrainings makes and runs the courses. Pact sells them and handles your order and support. Buyers must be 18 or older, and all sales are final.

OSHA says it does not approve, certify, or endorse individual trainers or training programs. So no course is "OSHA approved," including these.

Use a course for the general content. Then add what only the office can teach: your exposure control plan, your chemicals and data sheets, your exits and extinguishers, and your HIPAA policies. Remember that bloodborne pathogens training must be free to the employee, so the office pays.

Common questions

Do dental offices have their own OSHA standard?

No. OSHA says there are currently no specific OSHA standards for dentistry. General industry standards, such as bloodborne pathogens and hazard communication, apply.

How often is bloodborne pathogens training required in a medical or dental office?

For employees with occupational exposure, at initial assignment and at least annually after that, within one year of the previous training (29 CFR 1910.1030(g)(2)(ii) and (iv)).

Can we have staff pay for their own bloodborne pathogens course?

No. OSHA requires the training to be provided at no cost to the employee and during working hours (1910.1030(g)(2)(i)).

Is HIPAA training required every year?

The Privacy Rule doesn't set a yearly schedule. It requires training for new workforce members within a reasonable time and after material policy changes. An office can choose to train every year.

Does a small office need a written emergency action plan?

Where a standard requires an emergency action plan, it must be written, but an employer with 10 or fewer employees may communicate it orally (1910.38(b)).

Are Pact's courses OSHA approved?

No course is. OSHA says it does not approve, certify, or endorse individual trainers or training programs. The courses are made by ProTrainings and sold by Pact.