Texas Dental Office Compliance: The Complete Guide for 2026

Who regulates a dental office in Texas?

A Texas dental office is regulated by both state and federal authorities, and the practice owner (usually the dentist of record) is responsible for compliance across all of them. The core regulators and their jurisdiction:

• Texas State Board of Dental Examiners (TSBDE) — licenses dentists, dental hygienists, and dental assistants and sets standards of professional conduct. Its authority comes from the Texas Dental Practice Act (Texas Occupations Code, Chapters 251–267), and its rules live in Title 22 of the Texas Administrative Code (TAC), Part 5 (Chapters 100 and following).
• OSHA (federal) — governs employee safety, including the Bloodborne Pathogens standard and Hazard Communication standard. Texas does not run its own state OSHA plan for private-sector employers, so federal OSHA rules apply directly to Texas dental offices with employees.
• HHS Office for Civil Rights (HIPAA) — enforces patient-privacy and data-security rules for practices that transmit health information electronically (essentially every modern dental office).
• Texas DSHS Radiation Control Program — registers and regulates dental x-ray machines under 25 TAC Chapter 289.
• CDC — publishes the infection-control guidelines that the TSBDE and standard of care effectively require Texas practices to follow.

Other bodies touch specific activities: the U.S. Drug Enforcement Administration (DEA) and the Texas Prescription Monitoring Program for controlled substances, the Texas Commission on Environmental Quality (TCEQ) and EPA for medical and amalgam waste, and the Texas Department of Licensing and Regulation for some facility matters. The takeaway: compliance is not one checklist from one agency — it is several overlapping programs that all apply at once.

TSBDE rules every Texas dental practice must follow

The Texas State Board of Dental Examiners sets the professional-practice rules that define minimum standard of care, recordkeeping, infection control, and who is allowed to do what in the operatory. These rules are found in 22 TAC, Part 5, and the ones that matter most day to day include:

• Minimum standard of care and dental records. 22 TAC §108.7 sets the general standard of care, and 22 TAC §108.8 ("Records of the Dentist") governs what must be in a patient record and how long it is kept. Records must be retained for at least five years from the date of last treatment; for a patient who was a minor at last treatment, records must be kept until the patient turns 21 or for five years, whichever is longer.
• Sterilization and infection control. 22 TAC §108.24 requires sterilization of instruments used intraorally or in contact with tissue using a recognized method (steam autoclave, chemical vapor, dry heat, ethylene oxide, or a listed chemical sterilant), pre-cleaning of instruments so they are free of visible debris, single use of disposable items, and handling of contaminated items as biohazardous material.
• Sedation and anesthesia. A dentist who administers sedation or general anesthesia must hold the appropriate permit and meet the facility, monitoring, and emergency requirements in 22 TAC Chapter 110.
• Auxiliary personnel scope. Registered dental assistants and dental hygienists may only perform delegated duties within their authorized scope; assistant registration and permitted duties are set out in 22 TAC Chapter 114, and hygienist duties in the related chapters.
• Continuing education, CPR, and jurisprudence. Licensees must complete continuing education each renewal cycle under 22 TAC Chapter 104, maintain current basic life support (CPR) certification, and satisfy Texas-specific requirements such as a state-approved human trafficking prevention course.

The TSBDE can inspect, investigate complaints, and impose discipline ranging from a reprimand to probation, administrative penalties, suspension, or revocation of a license. Because the board updates its rules regularly, verify current requirements — including CE hour counts — against the live rule text before relying on them.

OSHA Bloodborne Pathogens Standard and your Exposure Control Plan

If your dental office has even one employee, the OSHA Bloodborne Pathogens standard (29 CFR 1910.1030) applies to you, and the centerpiece of compliance is a written Exposure Control Plan. Dental settings are explicitly covered because staff routinely have reasonably anticipated contact with blood and other potentially infectious material (OPIM).

What the standard requires:

• A written Exposure Control Plan that identifies job classifications with occupational exposure, describes your controls, and is reviewed and updated at least annually and whenever tasks or procedures change. It must document your consideration and use of safer medical devices (for example, self-sheathing needles and sharps with engineered injury protection).
• Hepatitis B vaccination offered to all employees with occupational exposure, at no cost, within 10 working days of assignment; employees who decline must sign the specific OSHA declination statement.
• Universal precautions and engineering/work-practice controls — sharps disposal in approved containers, no recapping by hand, handwashing facilities, and prohibition of eating, drinking, or storing food where blood or OPIM are present.
• Personal protective equipment (PPE) — gloves, masks, eye protection, and gowns provided and maintained at no cost to the employee.
• Post-exposure evaluation and follow-up — a documented procedure for needlesticks and other exposure incidents, including confidential medical evaluation and follow-up at no cost to the employee.
• A sharps injury log for practices required to keep OSHA injury records.
• Annual training for all employees with occupational exposure, at no cost and during working hours, with training records retained for three years.

Having the written plan on a shelf is not enough — OSHA compliance means the plan reflects what you actually do and that you can show training, vaccination offers, and exposure follow-ups were carried out.

OSHA Hazard Communication: chemicals in the dental office

The OSHA Hazard Communication standard (29 CFR 1910.1200) requires every dental office to have a written hazard communication program covering the chemicals employees work with — and dental offices use plenty, from disinfectants and cold sterilants to etchants, bonding agents, developer solutions, and nitrous oxide. This is often the most overlooked OSHA obligation in small practices.

To comply, a Texas dental office must:

• Maintain a written hazard communication program describing how it handles labeling, safety data sheets, and training.
• Keep a chemical inventory (a list of the hazardous chemicals present in the workplace).
• Maintain a Safety Data Sheet (SDS) for each hazardous chemical, readily accessible to staff during every shift.
• Ensure proper labeling of all containers, including secondary containers into which chemicals are transferred, using the Globally Harmonized System (GHS) pictograms, signal words, and hazard statements.
• Train employees at initial assignment and whenever a new chemical hazard is introduced, covering how to read labels and SDSs, the hazards present, and protective measures.

Nitrous oxide deserves specific attention: offices that use it should follow manufacturer and NIOSH guidance on scavenging systems and exposure control. Keep your SDS binder (or electronic equivalent) current — outdated or missing SDSs are among the most common citations OSHA issues to dental practices.

Infection control and sterilization: CDC guidelines meet Texas rules

Texas dental practices are expected to follow CDC infection-control guidance, and the TSBDE's sterilization rule (22 TAC §108.24) makes core elements of it enforceable. The two foundational CDC documents are the "Guidelines for Infection Control in Dental Health-Care Settings — 2003" and the CDC's "Summary of Infection Prevention Practices in Dental Settings" (2016), which includes a practical infection-prevention checklist.

An effective, defensible infection-control program in a Texas office generally includes:

• A written infection-control program with a designated infection-control coordinator.
• Instrument processing that follows the cycle of cleaning (ultrasonic or instrument washer), packaging, sterilization, and proper storage; instruments must be free of visible debris before sterilization.
• Heat sterilization of all heat-tolerant critical and semi-critical instruments, with each sterilizer used and maintained per manufacturer instructions.
• Biological (spore) monitoring of each sterilizer at least weekly using a biological indicator, per CDC recommendation, plus routine chemical and mechanical indicators, with results documented and retained.
• Surface disinfection using an EPA-registered hospital disinfectant, with surface barriers where appropriate.
• Safe injection practices, single-use of disposable items, and correct handling of dental unit waterlines to meet water-quality recommendations.
• Hand hygiene, PPE, and respiratory hygiene protocols.
• Proper handling of contaminated impressions, casts, and lab items so they are rendered non-biohazardous before transport, as 22 TAC §108.24 requires.

Documentation is what turns good practice into demonstrable compliance: keep your sterilizer monitoring logs, maintenance records, and written protocols where you can produce them on request.

HIPAA and Texas HB 300: protecting patient records

Dental practices are covered entities under HIPAA, so they must comply with the HIPAA Privacy, Security, and Breach Notification Rules (45 CFR Parts 160 and 164) — and in Texas, the stricter Texas Medical Records Privacy Act (HB 300, Texas Health and Safety Code Chapter 181) applies on top of them.

HIPAA core obligations for a dental office:

• A documented Security Risk Analysis of electronic protected health information (ePHI), updated periodically, with a risk-management plan (45 CFR Part 164, Subpart C). This is one of the most frequently cited gaps in OCR enforcement.
• Written policies and procedures and administrative, physical, and technical safeguards (access controls, unique user IDs, audit controls, encryption where appropriate, workstation security).
• A Notice of Privacy Practices provided to patients, plus a designated Privacy Officer and Security Officer.
• Business Associate Agreements with vendors that handle PHI (billing services, IT providers, cloud practice-management and imaging systems, shredding companies).
• Breach notification procedures consistent with 45 CFR Part 164, Subpart D.

Texas HB 300 adds requirements that go beyond federal law:

• Customized privacy training for every employee who handles PHI, provided within 90 days of hire and repeated within a reasonable period (no later than one year) after a material change in the relevant state or federal law, with signed proof of completion retained.
• Faster electronic-record access — under Texas Health and Safety Code §181.102, a provider using a capable electronic health record system must provide a patient's electronic health record within 15 business days of a written request, faster than HIPAA's 30-day standard.
• Restrictions on the sale and certain marketing uses of PHI.

HIPAA civil penalties are tiered by culpability and can reach into the millions of dollars for the most serious categories of violations, and Texas can impose its own penalties under HB 300 — so treat privacy and data security as an active, maintained program, not a one-time paperwork exercise.

Radiation safety for dental x-rays in Texas

Every dental x-ray machine in Texas must be registered with the Texas Department of State Health Services (DSHS) Radiation Control Program, and the practice must operate it under the safety rules in 25 TAC Chapter 289. The general registration requirement for radiation machines is in 25 TAC §289.226, and the dental-specific standards are in 25 TAC §289.232 ("Radiation Control Regulations for Dental Radiation Machines").

Key requirements for a dental office:

• Register each x-ray machine (intraoral, panoramic, and cone-beam CT units) with DSHS and keep the registration current, paying applicable registration and renewal fees.
• Maintain written operating and safety procedures for the safe use of each machine, available to operators.
• Follow ALARA (As Low As Reasonably Achievable) — use proper technique, collimation, and patient shielding consistent with current guidance, and limit exposure to only what is diagnostically necessary.
• Restrict who operates the equipment. Under TSBDE rules, a dental assistant may not position or expose dental x-rays unless the assistant holds a dental assistant radiology certificate issued by the board (or is otherwise qualified).
• Quality assurance for digital and CBCT systems — follow the manufacturer's quality-assurance protocol, or develop your own if none exists, and keep the equipment properly maintained and calibrated.
• Keep records of registration, machine service and calibration, and operator qualifications.

Radiation registrations are subject to DSHS inspection, and operating an unregistered machine or failing to meet safety-procedure requirements can result in administrative penalties. Confirm current fees, renewal timing, and any shielding-evaluation requirements directly with the DSHS Radiation Control Program.

Staff training, credentials, and recordkeeping

Compliance in a dental office is substantially a documentation exercise: the requirement is not only to do the right things but to prove you did them, on time, for every staff member. Regulators frequently open an investigation and simply ask for records — and missing records are treated as missing compliance.

Credentials to verify and keep on file for each team member:

• Current TSBDE license or registration for every dentist, hygienist, and registered dental assistant, plus dental assistant radiology certificates where staff take x-rays.
• Current CPR/BLS certification for clinical staff.
• Continuing education records demonstrating each licensee met the required hours and mandatory courses each renewal period.

Recurring training that must be documented:

• OSHA Bloodborne Pathogens training — at hire and annually; retain records for three years.
• OSHA Hazard Communication training — at hire and when new chemical hazards are introduced.
• HIPAA and HB 300 privacy/security training — HB 300 training within 90 days of hire, with periodic refreshers and signed acknowledgments.

Core documents and logs to maintain:

• Written Exposure Control Plan (reviewed annually), written Hazard Communication program and SDS library, and written infection-control protocols.
• HIPAA Security Risk Analysis, policies and procedures, Notice of Privacy Practices, and Business Associate Agreements.
• Sterilizer biological-monitoring logs and equipment maintenance records.
• Hepatitis B vaccination offers and declinations, and any exposure-incident follow-up records.
• Radiation machine registration and service records.
• Patient records retained for the periods required by 22 TAC §108.8.

A useful rule of thumb: if a regulator can review a stack of dated logs, signed acknowledgments, and current written plans, you are demonstrating compliance. If those documents are missing or stale, even a well-run clinical operation can be cited.

Beyond the basics: controlled substances, waste, and mandatory reporting

Several additional obligations apply to Texas dental offices depending on what the practice does, and they are easy to overlook because they sit outside the everyday TSBDE and OSHA framework.

• Controlled substances and the Prescription Monitoring Program. A dentist who prescribes controlled substances must hold a current DEA registration and comply with Texas Prescription Monitoring Program (PMP) requirements administered through the Texas State Board of Pharmacy, including checking a patient's PMP history before prescribing certain controlled substances. Texas also generally requires electronic prescribing of controlled substances, subject to available waivers.
• Medical and sharps waste. Regulated medical waste (including sharps and other biohazardous waste) must be segregated, stored, and disposed of in accordance with Texas rules for medical waste management; use a licensed medical-waste transporter and keep manifests.
• Dental amalgam waste. Practices that place or remove amalgam are subject to the EPA dental effluent rule (40 CFR Part 441), which generally requires an amalgam separator and best-management practices for amalgam waste, along with a one-time compliance report.
• Mandatory reporting. Texas dentists and their staff are mandatory reporters of suspected child abuse or neglect under Texas Family Code Chapter 261, and licensees have professional reporting obligations to the TSBDE in certain circumstances.
• Accessibility. As places of public accommodation, dental offices are subject to the Americans with Disabilities Act (ADA), including physical-access and effective-communication requirements.
• 2025 statutory and rule changes. Texas amended several health-practice statutes and updated dental rules in 2025. If your practice offers services that may be affected, confirm the current requirements against the live rule text before relying on older guidance.

None of these applies to every practice, but each applies to some — so map your specific services against this list rather than assuming they do not concern you.