Texas Dental Office
Compliance Manual

Regulatory Overview & Agency Guide

A Texas dental office answers to four separate authorities at the same time, and each one asks for different paperwork. The state board sets professional and recordkeeping standards, a separate state program registers every x-ray machine in the building, federal OSHA governs staff safety, and federal and Texas privacy law both apply to the same patient record.

None of them coordinate with each other. An office can be entirely current with the dental board and still be cited for an unregistered panoramic unit or an Exposure Control Plan that was never reviewed. This chapter sets out who asks for what, so nothing falls between the agencies.

1.1  Who Regulates You

These are the bodies whose rules your documentation has to satisfy. Each one can inspect, and each one asks for different evidence.

Agency	Jurisdiction	What they ask for
Texas State Board of Dental Examiners (TSBDE)	Professional conduct, recordkeeping, infection control	Dental Practice Act (Occupations Code Ch. 251–267), 22 TAC Part 5, sterilization monitoring, records retention
DSHS Radiation Control Program	Every radiation-emitting machine	Registration of intraoral, panoramic and cone-beam units, written operating and safety procedures, ALARA
Federal OSHA	Employee safety	Bloodborne Pathogens (29 CFR 1910.1030), Hazard Communication (29 CFR 1910.1200), sharps injury log
HHS Office for Civil Rights & Texas AG	Patient privacy and data security	HIPAA Privacy and Security Rules, Texas HB 300 (Health & Safety Code Ch. 181)

1.2  Texas State Board of Dental Examiners

TSBDE licenses dentists, hygienists and registered assistants, and sets the professional-conduct and recordkeeping rules in the Dental Practice Act (Occupations Code Ch. 251–267) and 22 TAC Part 5.

For documentation purposes the board's reach is broader than most offices expect. It covers your infection control program and the designated coordinator who owns it, sterilization monitoring and the records proving it happened, the credentials of every clinical role including which assistants may expose radiographs, and how long you keep patient records and what those records must contain.

The board can assess administrative penalties of up to $5,000 per violation, with each day a violation continues treated as a separate violation (Occupations Code §264.002). A separate informal track caps at $1,000 per violation and $3,000 per calendar year.

1.3  DSHS Radiation Control Program

Every radiation machine in the office — intraoral, panoramic, and cone-beam CT alike — must be registered with the DSHS Radiation Control Program under 25 TAC §289.226, and operated according to the dental-specific rules in 25 TAC §289.232.

Registration is not a one-time event. It has to be kept current, written operating and safety procedures must be available at the unit, and you need service and calibration records. ALARA principles and patient shielding practices apply to every exposure.

This is the requirement most likely to be quietly out of date, because a machine bought years ago keeps working perfectly whether or not its registration was renewed.

1.4  Federal OSHA

Texas does not operate a state OSHA plan for private employers, so federal OSHA rules apply directly from your first employee. Two standards do most of the work in a dental setting.

The Bloodborne Pathogens standard (29 CFR 1910.1030) requires a written Exposure Control Plan, reviewed and updated at least annually and whenever procedures change, with the evaluation of safer sharps devices documented. It also requires hepatitis B vaccination offered within 10 days of assignment, annual training with records kept three years, and a sharps injury log.

The Hazard Communication standard (29 CFR 1910.1200) requires a Safety Data Sheet for every chemical on site, labels on all containers including anything decanted into a secondary bottle, and training at assignment and whenever a new hazard appears.

1.5  HIPAA and Texas HB 300

Both apply to the same patient record, and Texas is stricter in three ways worth knowing.

HB 300 (Health & Safety Code Ch. 181) defines “covered entity” more broadly than HIPAA — broadly enough to reach practices that never bill insurance. It requires customized privacy training for employees who handle protected health information within 90 days of hire, with signed proof. And where records are held in a capable electronic system, it requires them to be provided within 15 business days of a written request, against HIPAA's 30.

Work to the stricter number in each case and you satisfy both.

1.6  Record Retention

Under 22 TAC §108.8, dental records are kept for at least five years from the date of last treatment. Where the patient was a minor at the time of last treatment, records are kept until the patient turns 21 or for five years, whichever is longer.

Other rules can require longer — Medicaid, billing, and malpractice considerations among them — so the working rule is to keep records at least as long as the strictest requirement that applies to you. OSHA employee exposure and medical records have their own, much longer horizon: the duration of employment plus 30 years.