Dental Office Policies and Procedures Manual: What Goes in It

The employee handbook and the procedures manual are different documents with different jobs.

The handbook is the HR document: paydays, time off, conduct, discipline, benefits and the complaint route.

The procedures manual is the operations and clinical document: how instruments get processed, what happens after an exposure incident, who checks the sterilizer, how a records release goes out the door.

A practice needs both, and each should point to the other instead of repeating it.

The HR side is covered in our employee handbook guide; this page is the manual that sits next to it.

Keep the boundary clean by giving each document a cross-reference line.

The handbook says clinical and safety procedures live in the procedures manual; the manual's front-office chapter says pay and leave questions are answered in the handbook.

Writing a policy twice is how version drift starts: you update one copy, forget the other, and the documents disagree in front of an employee or an inspector.

What goes in the manual is part compliance, part operations.

Some chapters are written programs regulators actually require you to have, and those come first; the rest are protocols no one demands but your Tuesday-morning coverage absolutely does.

The chapters below run in that order.

Start with the written programs OSHA's rules require, because these are the chapters the rules themselves name.

There is no OSHA standard written specifically for dentistry; OSHA says so itself, and dental offices are covered instead by its general industry standards, principally the Bloodborne Pathogens standard and the Hazard Communication (HazCom) standard.

Which OSHA rules that means for you also depends on where you practice: OSHA lists 22 State Plans, 21 of them states plus Puerto Rico, that cover private-sector as well as state and local government workplaces, and those State Plans must be at least as effective as federal OSHA's and may be more stringent.

A manual copied from a template in another State Plan state can miss requirements your state adds.

The Exposure Control Plan.

Every employer with an employee who has occupational exposure must establish a written Exposure Control Plan designed to eliminate or minimize that exposure.

Three parts give it its structure: the exposure determination, the schedule and method for implementing the standard's requirements, and the procedure for evaluating exposure incidents.

The exposure determination lists the job classifications in which all employees have occupational exposure and those in which some do, naming the tasks involved, and it is made without regard to personal protective equipment.

A copy must be accessible to employees, so keep it where staff can actually reach it during a shift rather than filed away.

It is a living document: review and update it at least annually and whenever new or modified tasks, procedures or positions affect occupational exposure.

The annual review is more than a re-read, because you must document your consideration and implementation of safer medical devices and document that you solicited input from the non-managerial employees who handle direct patient care.

In California, Cal/OSHA's version of the plan must also be reviewed and updated at least annually with a look back at exposure incidents since the previous update.

The written hazard communication program.

Every workplace covered by HazCom must maintain a written program describing how it will meet the labels, safety data sheets and training requirements, including a list of the hazardous chemicals known to be present.

Employees must be told where the written program, the chemical list and the safety data sheets are kept, so state the location in the manual rather than assuming everyone knows.

The standard has one limit worth writing down too: it does not reach consumer products used in the workplace for their intended purpose when the duration and frequency of exposure are no greater than a consumer's.

For the compliance program built on top of these documents — training calendars, who oversees what — our career guide to OSHA in the dental office picks that up, and our OSHA training guide covers when each new hire has to be trained and for how long records are kept.

The Privacy Rule requires a HIPAA covered entity to implement privacy policies and procedures designed to comply with its standards, to change them as needed to comply with changes in the law, and to keep them in written or electronic form.

The rules contemplate practices of different sizes: the policies should be reasonably designed considering the entity's size and activities.

The size-and-activities test means a single-location office's policies are scaled to its own operations rather than copied from a hospital's — but they do need to be genuinely yours, written around how your team touches patient information.

Four contents are easy to miss when the policies get drafted.

First, sanctions: the Privacy Rule requires appropriate sanctions against workforce members who fail to comply with privacy policies, applied and documented, and the Security Rule separately requires a sanction policy for failures to comply with security policies.

Second, a named security official responsible for developing and implementing the security policies.

Third, a risk analysis of potential risks and vulnerabilities to electronic protected health information, which is a required specification, not an optional extra.

Fourth, retention: privacy documentation is kept 6 years from creation or the date last in effect, whichever is later, and Security Rule documentation carries the same 6-year retention, must be made available to the people who implement it, and must be reviewed periodically and updated as needed.

One timing note: HHS published a proposed overhaul of the Security Rule on January 6, 2025, and as of October 7, 2026 it still appeared in the Federal Register as a proposed rule, with no final rule found.

Build your policies to the rule in force; do not treat the proposals as current law.

For the privacy and security program as a whole — training, access changes when staff leave, breach response — our career guide to HIPAA in the dental office covers running it, and our HIPAA training guide covers bringing each new hire inside it.

Infection control.

CDC's Guidelines for Infection Control in Dental Health-Care Settings—2003 are archived but still serve as the standard of practice for clinical dentistry, alongside the later CDC recommendations collected in the Summary of Infection Prevention Practices in Dental Settings.

CDC recommends that at least one individual trained in infection prevention — the infection prevention coordinator — be responsible for developing written infection prevention policies and procedures, and that those policies be reassessed on a regular basis, for example annually, or according to state or federal requirements.

These are CDC recommendations rather than federal legal requirements, but they are the skeleton of the clinical chapter: someone owns it, the policies are written, and they get revisited on a schedule.

States can add written-protocol requirements of their own, and the verified example in this guide's research is California: the Dental Board's infection control rule (16 CCR 1005) requires a written protocol for proper instrument processing, operatory cleanliness and management of injuries, made available to all dental health care personnel, plus a copy of the regulation conspicuously posted in each dental office.

The same rule requires at least weekly biological-indicator (spore) testing of every sterilizer, with results documented and kept 12 months, and California employers must keep evidence, for the length of the dental assistant's employment at the facility, that the assistant met and maintained all certification requirements.

If you practice in California, those are manual chapters; if you practice elsewhere, ask your own state dental board what it requires in writing and posted.

Radiation safety.

State radiation-safety written-program requirements were outside this guide's research, so this page cannot tell you what your state demands.

Ask your state's radiation-control program what it requires in writing — machine registration, quality-assurance records and posting are the questions to ask — and file the answers as a manual chapter with the certificates and test records behind it.

Emergencies.

The federal rules put one emergency procedure in writing themselves: the Exposure Control Plan must include the procedure for evaluating exposure incidents, so the needlestick and splash protocol belongs in this manual, not just in someone's head.

For medical emergencies, what each state dental board expects a practice to document was outside this guide's research.

Document what you can defend regardless — who calls 911, who retrieves the emergency kit, where the drugs are, which hospital you direct people to — and ask your state dental board whether it requires emergency-preparedness documentation on top of that.

Our research turned up no written-program mandate for front-office workflows the way the exposure control plan has one, but the front office is where unwritten policy gets expensive, because it decides what gets billed, collected and rebooked.

Write down the decisions you are already making by habit:

• Scheduling and confirmations. How appointments are confirmed, when a broken appointment is flagged, and what happens after repeated no-shows.
• Payment and collections. When payment is due, what you accept, how a payment plan gets approved, and who signs off on a write-down.
• Insurance workflows. Who verifies benefits, who submits claims, how rejections get worked, and what you tell a patient when coverage differs from the estimate.
• Records requests. Who releases records, what gets copied, and how the authorization is checked — this is the front-desk end of the HIPAA chapter above.
• New patients and recalls. Intake, how charts get created, and the recall system that decides who gets called when.
• Phones and opening/closing. How calls are answered and routed, what the opening checklist covers, and who locks up.

Little of this comes from a regulator.

Its value shows up when someone is out: a documented front office survives a resignation week, an undocumented one re-learns everything by trial and error.

It is also the chapter new front-desk hires train against.

When you are hiring for those seats, the dental hiring hub collects the rest of our employer guides.

A manual is only as good as its review calendar, and the review obligations differ by chapter:

• Exposure Control Plan: at least annually, plus on change. Review and update it at least annually and whenever new or modified tasks, procedures or positions affect occupational exposure. The annual review must document consideration and implementation of commercially available safer medical devices, and you must solicit and document input from non-managerial employees responsible for direct patient care on engineering and work-practice controls. Cal/OSHA's California version adds a look back at exposure incidents since the previous update.
• HIPAA: periodic, and on operational change. Security Rule documentation is reviewed periodically and updated in response to environmental or operational changes; privacy policies change as the law changes.
• Infection control: regularly, for example annually. CDC recommends that dental infection prevention policies be reassessed on a regular basis (for example, annually) or according to state or federal requirements, and the coordinator responsible for the written policies is the natural owner of that review.

Give every chapter a named owner so each review date has a person attached: the infection prevention coordinator for the clinical protocols, the security official for HIPAA, the office manager for the front-office chapter, and the dentist-owner signing off on the whole.

Record each review — date, who, what changed — because a review nobody documented is hard to distinguish from a review that never happened.

Keep superseded versions.

HIPAA documentation is retained 6 years from creation or the date last in effect, whichever is later, so last year's policy may still need to exist.

The records behind the manual run on their own clocks:

Two footnotes on the sharps injury log rows.

Under federal OSHA, the sharps injury log requirement applies only to employers required to keep OSHA injury and illness logs, and Offices of Dentists (NAICS 6212) are listed as a partially exempt industry for that recordkeeping, so dental offices generally need not keep the logs regardless of size unless the government asks.

California is the verified state difference: every employer covered by its bloodborne pathogens standard must keep a Sharps Injury Log, with each exposure incident involving a sharp recorded within 14 working days of the report.