The HIPAA Breach Notification Rule: What Dental Practices Must Do When Patient Information Is Compromised

Jordan Uditsky • August 7, 2024

Every dental practice is sitting on a fortune. The patient information they electronically collect, maintain, store, and use is a potential gold mine for hackers, cybercriminals, and other technological bad actors who can sell and leverage that data for their own gain or nefarious ends. For these reasons, dentists and all other healthcare providers, facilities, and the vendors they work with are ripe and continuous targets for cyberattacks and data breaches.

 

Such occurrences can quickly metastasize into a legal, financial, and reputational nightmare for dental practice owners. And dental practices and dental service organizations are waking up to these nightmares with increasing frequency. According to the Ponemon Institute, dental practices experienced a 45% increase in data breaches in the last two years, with the average cost of a healthcare data breach reaching $9.23 million.

 

As we discussed in this earlier post, the HIPAA Security Rule imposes detailed and technical compliance obligations on dental practices regarding the protection of patients’ electronic personal health information (ePHI). But when a breach does occur, practice owners must take quick, decisive actions on several fronts to triage the situation and remediate the damage. This includes making required disclosures and providing notice of the breach as set forth in the HIPAA Breach Notification Rule.

 

The Breach Notification Rule mandates that covered entities, including dental practices, notify affected individuals, the Secretary of the Department of Health and Human Services (HHS), and, in certain cases, the media of a breach of unsecured PHI.

 

What Constitutes a Breach?

 

For purposes of the Breach Notification Rule, a breach is defined as the acquisition, access, use, or disclosure of PHI in a manner not permitted under HIPAA, which compromises the security or privacy of the PHI. This does not include unintentional access by a workforce member, inadvertent disclosure by a person authorized to access PHI, or when the unauthorized person to whom the disclosure is made would not reasonably have been able to retain the information.

 

PHI is considered unsecured if it is not rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of encryption or destruction. Breaches of secured PHI (i.e., encrypted data) do not require notification as set forth below.

 

Risk Assessment and Notification Requirements After Breach Discovered

 

Once a practice becomes aware of a potential data breach, it must conduct a risk assessment to determine if there is a low probability that the PHI has been compromised. Factors to consider in such an assessment include the nature and extent of the PHI involved, the unauthorized person who used or received the PHI, whether the PHI was actually acquired or viewed, and the extent to which the risk has been mitigated.

 

Within 60 days after the discovery of a breach, a dental practice must provide notice to any affected patients that includes:


  • A description of the breach
  • The types of information involved
  • The steps individuals should take to protect themselves
  • What the practice is doing to investigate and mitigate the breach, and
  • Contact information for further inquiries.

 

Notice to HHS

 

For breaches affecting more than 500 residents of a state or jurisdiction, practices must notify HHS as well as local media outlets of the breach. Specifically, the practice must notify HHS at the same time it provides notice to affected individuals. That notice must be given “without unreasonable delay” and in no case later than 60 calendar days after the discovery of a breach of security. For breaches involving fewer than 500 people, covered entities must notify HHS annually and no later than 60 calendar days following the end of the year.

 

What Dentists Need To Do To Comply With The Breach Notification Rule

 

While the Notification Rule’s obligations don’t kick in until after a breach, dental practices should take several steps before a breach happens to ensure compliance and minimize the damage and fallout:


  • Develop and Implement Policies and Procedures: Dentists should establish written policies and procedures for managing PHI and addressing potential breaches. These should include processes for identifying, investigating, and responding to breaches, conducting risk assessments, and notifying affected individuals and the appropriate authorities.
  • Regular Staff Training: All staff members should be trained on HIPAA regulations, including the Breach Notification Rule, and the office's specific policies and procedures for handling PHI. Regular training ensures that staff members are aware of their responsibilities and can recognize and report potential breaches.
  • Implement Security Measures: As noted, dentists should implement administrative, physical, and technical safeguards to protect PHI as set forth in the HIPAA Security Rule. This includes using encryption for electronic PHI, securing physical records, controlling access to information, and using secure communication channels.
  • Establish a Breach Response Team: Having a designated team responsible for managing breaches ensures a coordinated and effective response. This team should include individuals from different areas of the practice, such as IT, legal, and compliance.
  • Maintain an Incident Response Plan: An incident response plan outlines the steps to take when a breach is suspected or detected. It should include procedures for containment, investigation, risk assessment, notification, and mitigation.

 

Compliance with the Breach Notification Rule is just one of many actions dental practices must take in the unfortunate event of a data breach. In our next post, we will discuss several other aspects of data breach response and mediation, all of which are crucial to protecting practices and patients alike.

 

HIPAA Breach Notification Questions? Call Grogan, Hesse & Uditsky Today

 

At Grogan, Hesse & Uditsky, P.C., we focus a substantial part of our practice on providing exceptional legal services for dentists and dental practices, as well as orthodontists, periodontists, endodontists, pediatric dentists, and oral surgeons. We bring unique insights and deep commitment to protecting the interests of dental professionals and their practices and we welcome the opportunity to work with you.

 

If you have questions or concerns about your practice’s compliance with the HIPAA Breach Notification Rule, please call us at (630) 833-5533 or contact us online to arrange for your free initial consultation.

 

Jordan Uditsky, an accomplished businessman and seasoned attorney, combines his experience as a legal counselor and successful entrepreneur to advise dentists and other business owners in the Chicago area. Jordan grew up in a dental family, with his father, grandfather, and sister each owning their own dental practices, and this blend of legal, business, and personal experience provides Jordan with unique insight into his clients’ needs, concerns, and goals.

Speak to an Attorney

Related Posts
By Jordan Uditsky • October 21, 2026
Getting in Sync: The Practical Challenges of Integrating Your Practice With a DSO  Almost all mergers, whether they involve two giant corporations or two new spouses, present a multitude of challenges. Each party has their own way of doing things, each may possess capabilities or infrastructure that are duplicative of the other, and each will need to get used to a new dynamic that may, at first, cause some friction and pushback. Such is the case when an independent dental practice must integrate its operations, policies, and affairs with those of a far larger dental service organization (DSO) after the latter acquires the former. While the management services agreement (MSA) and other documentation behind a DSO acquisition may address a broad spectrum of issues, including those affecting integration, the practical, on-the-ground realities of combining two businesses can make the transition difficult for the practice and the DSO alike. An MSA that may look straightforward on paper can become much more complicated once the practice is operating within the DSO's platform. The most successful integrations recognize such issues early and establish clear lines of responsibility between the clinical practice and the DSO. Are you interested in speaking with one of our attorneys? Click here to contact us now. Aligning the MSA With Day-to-Day Operations The MSA should clearly identify the services the DSO will provide, such as billing, human resources, accounting, procurement, information technology, marketing, and facilities management. But the parties should also understand how those services will actually be delivered, including such granular but critical matters as: Who must approve expenditures Who hires and terminates nonclinical employees Who controls the practice's bank accounts Who manages payer enrollment and credentialing Who owns the patient records and other data Who is responsible for regulatory compliance Ambiguity can lead to disputes, particularly when the parties have different expectations about the DSO's role. A well-drafted MSA should be supported by practical integration procedures that translate contractual provisions into everyday operations. Employee and Staffing Integration The practice owner and the DSO may be the only parties with their signatures on an MSA, but the document also plays a big role in the fate and future of the practice’s employees. Compensation structures, benefits, payroll systems, timekeeping, job responsibilities, and reporting relationships may all change. Before integration, the parties should determine whether employees will remain employed by the professional practice, become employees of another affiliated entity, or transition under another arrangement permitted by applicable law. Counsel should also carefully review existing employment agreements and restrictive covenants to ensure that those documents are not in conflict with any relevant provisions of the MSA. Another common issue is the integration of compensation systems. A DSO may use standardized compensation models, bonus structures, or productivity metrics that differ from those historically used by the practice. Those changes should be reviewed not only for employment-law considerations but also for potential implications under healthcare fraud-and-abuse laws and applicable fee-splitting restrictions. Technology, Data, and Patient Records The technological infrastructure of a dental practice is complex enough on its own, but integrating its practice-management software, electronic records platform, accounting system, or communication tools to systems used throughout the DSO takes that complexity — and related risks — to another level. Patient records must remain accurate and accessible, and the parties must address applicable HIPAA privacy and security obligations when patient information is transferred, accessed, or stored by DSO personnel and vendors. The integration plan should address data ownership, access rights, cybersecurity responsibilities, backup procedures, retention requirements, and procedures for responding to security incidents. A rushed technology conversion can disrupt patient care and lead to costly but avoidable compliance problems. Branding and Patient Relationships DSOs frequently seek to standardize branding, marketing, websites, telephone systems, and patient communications. While consistency can be valuable, practices should consider how these changes affect existing patient relationships. Patients may be confused if a familiar practice suddenly adopts a new name, website, phone number, or communication style. The integration plan should provide a thoughtful transition that explains changes without undermining patient confidence. Counsel should also review marketing materials for compliance with applicable advertising rules. Dental practices remain subject to professional obligations even when a centralized DSO team manages marketing and communications. Financial Integration and Revenue Cycle Management Another major integration issue is the transition to the DSO's accounting and revenue-cycle systems. Differences in billing procedures, collection policies, payer relationships, and financial reporting can produce surprises after closing. The parties should establish clear procedures for accounts receivable, refunds, patient balances, insurance claims, write-offs, and reconciliation. They should also determine how financial information will be reported to the practice and its owners. These issues are especially important where the selling dentist continues to own the professional entity or retains an economic interest in its operations. Consider and Address Practical Integration Issues Before Closing It’s one thing for a newly cohabitating couple to combine their kitchenware, furniture, and checking accounts; it’s quite another to merge two operationally complex, heavily regulated, and technologically dependent businesses with each other. Perhaps the most important lesson is that dental practice/DSO integration should not be treated simply as a matter of documentation or an administrative project that begins after the transaction closes. It should be part of the transaction planning process. Before closing, the parties should identify critical systems, personnel, vendors, contracts, licenses, payer relationships, technology platforms, and regulatory requirements. They should establish an integration timeline and assign responsibility for each major task. The parties must ensure that the legal structure, MSA, operational procedures, technology, employment arrangements, and clinical responsibilities work together. For dentists selling to or partnering with a DSO, experienced legal counsel can help identify integration risks before they become post-closing problems. If you are considering selling your dental practice to a DSO, please call Grogan Hesse & Uditsky at (630) 833-5533 or contact us online to arrange for your free initial consultation. We Focus on You So You Can Focus on Your Patients At Grogan, Hesse & Uditsky, P.C., we focus a substantial part of our practice on providing exceptional legal services for dentists and dental practices, as well as orthodontists, periodontists, endodontists, pediatric dentists, and oral surgeons. We bring unique insights and deep commitment to protecting the interests of dental professionals and their practices and welcome the opportunity to work with you. Jordan Uditsky, an accomplished businessman and seasoned attorney, combines his experience as a legal counselor and successful entrepreneur to advise dentists and other business owners in the Chicago area. Jordan grew up in a dental family, with his father, grandfather, and sister each owning their own dental practices, and this blend of legal, business, and personal experience provides Jordan with unique insight into his clients’ needs, concerns, and goals.
By Jordan Uditsky • October 21, 2026
Respect My Authority: How Dental Practice Owners Can Preserve Clinical Autonomy After a Sale to a DSO Over the past several years, we have posted many articles on this blog discussing two particular topics: selling a dental practice to a dental service organization (DSO), and developments related to the corporate practice of dentistry by DSOs that stick their noses too much into a practice’s clinical operations and decision-making. At the center of the venn diagram linking these two issues is a concern that faces most dental practice owners when considering a sale to a DSO: how to maintain clinical autonomy and authority after a sale and prevent the DSO from interfering in this fundamental, non-administrative aspect of running a dental practice. While legislators and regulators debate about appropriate guardrails to put on DSOs to prevent their overreach into a dentist’s clinical responsibilities, it ultimately falls on the dental practice owner — and their counsel — to take the steps needed during negotiations to ensure that the documents governing the transaction include robust protections to preserve the dentist’s appropriate authority over clinical decisions. Are you interested in speaking with one of our attorneys? Click here to contact us now. Make Clinical Independence Explicit and Detailed in Writing One of the most important protections is an unequivocal contractual statement that clinical decisions remain under the licensed dentist's control. The purchase agreement, employment or professional services agreement, and other transaction documents should clearly distinguish between business decisions and clinical decisions. As with any contract, vagueness or lack of defined terms can plant the seeds of misunderstanding and conflict. Accordingly, a general promise that the dentist will maintain “clinical autonomy” without delineating what that actually means in practice is insufficient. The agreement should define what that autonomy means and identify decisions that cannot be dictated by non-clinical personnel, including, but not limited to: · Diagnosis · Treatment planning · Selection of appropriate treatment · Referrals · Patient communications concerning treatment · Prescribing · Use of clinical techniques and materials. Additionally, a dentist should consider provisions stating that treatment recommendations will be based on the patient's clinical needs and the dentist's independent professional judgment, rather than production targets, revenue goals, or other financial considerations. Establish Appropriate Limits on DSO Authority One of the main value-adds of selling to a DSO is that they typically assume responsibility for administrative services, including billing, scheduling, human resources, procurement, marketing, information technology, and facilities management. While many of these functions are easily distinguishable from clinical ones, there are areas where operational decisions could indirectly affect clinical care, such as scheduling policies, staffing levels, supply purchasing, laboratory arrangements, appointment lengths, and production incentives, all of which can have clinical implications. As such, the agreements should establish a clearly defined, workable boundary: the DSO manages the business, while the dentist retains authority over professional judgment. Compensation and Incentive Structures Can Pit Clinical Judgment and Business Objectives Against Each Other Compensation is another area that can create tension between a DSO’s business objectives and a dentist’s clinical judgment. Counsel should review an employment or services agreement to determine whether compensation formulas, production requirements, bonuses, quotas, or other incentives could pressure the dentist to recommend or perform treatment that the dentist would not otherwise recommend. That does not mean every production-based compensation arrangement is inappropriate. Rather, dentists should understand exactly how the formula works and consider contractual language confirming that compensation will not be contingent on making a particular clinical recommendation or on performing treatment the dentist does not believe is appropriate. One-Size-Fits-All Clinical Policies v. Individual Clinical Decisions Many DSOs have standardized policies that affect clinical practice which should be reviewed and addressed before closing. During due diligence and contract negotiations, practice owners and their counsel should understand the DSO's policies involving treatment protocols, referrals, supplies, laboratories, prescribing, infection control, scheduling, patient communications, and quality assurance. Such policies should allow appropriate clinical judgment where patient circumstances warrant an individualized approach, and the parties should establish how legitimate clinical exceptions will be handled. Clinical Autonomy Is Not a Set-It-and-Forget-It Issue The signing of documents at the consummation of a sale to a DSO may be the end of one process, but it is also marks the start of the actual, functioning relationship between the DSO and now-former practice owner. And that relationship can evolve over time in ways that can impact clinical autonomy. Another company may acquire the DSO; the practice could be transferred to another affiliated entity; and other management changes can alter or threaten the carefully negotiated dynamic reflected in the underlying agreements. Those agreements should address whether clinical-independence provisions survive such events and, where appropriate, whether they bind successors and affiliated entities. Selling a dental practice does not necessarily mean surrendering professional judgment. But clinical autonomy should not be left to assumptions, informal assurances, or legislators or regulators. It should be addressed explicitly in the transaction documents by sellers and their counsel. By doing so, dentists can reap the benefits of a DSO sale while retaining control over the one thing that no corporation or entity can or should: the practice of dentistry. If you are considering selling your dental practice to a DSO, please call Grogan Hesse & Uditsky at (630) 833-5533 or contact us online to arrange for your free initial consultation. We Focus on You So You Can Focus on Your Patients At Grogan, Hesse & Uditsky, P.C., we focus a substantial part of our practice on providing exceptional legal services for dentists and dental practices, as well as orthodontists, periodontists, endodontists, pediatric dentists, and oral surgeons. We bring unique insights and deep commitment to protecting the interests of dental professionals and their practices and welcome the opportunity to work with you. Jordan Uditsky, an accomplished businessman and seasoned attorney, combines his experience as a legal counselor and successful entrepreneur to advise dentists and other business owners in the Chicago area. Jordan grew up in a dental family, with his father, grandfather, and sister each owning their own dental practices, and this blend of legal, business, and personal experience provides Jordan with unique insight into his clients’ needs, concerns, and goals.
By Jordan Uditsky • October 14, 2026
With Recently Introduced Bill, Congress Enters the Corporate Practice of Medicine/Dentistry Fray. How Would It Impact Dental Practices and DSOs?
Show More
By Jordan Uditsky • October 21, 2026
Getting in Sync: The Practical Challenges of Integrating Your Practice With a DSO  Almost all mergers, whether they involve two giant corporations or two new spouses, present a multitude of challenges. Each party has their own way of doing things, each may possess capabilities or infrastructure that are duplicative of the other, and each will need to get used to a new dynamic that may, at first, cause some friction and pushback. Such is the case when an independent dental practice must integrate its operations, policies, and affairs with those of a far larger dental service organization (DSO) after the latter acquires the former. While the management services agreement (MSA) and other documentation behind a DSO acquisition may address a broad spectrum of issues, including those affecting integration, the practical, on-the-ground realities of combining two businesses can make the transition difficult for the practice and the DSO alike. An MSA that may look straightforward on paper can become much more complicated once the practice is operating within the DSO's platform. The most successful integrations recognize such issues early and establish clear lines of responsibility between the clinical practice and the DSO. Are you interested in speaking with one of our attorneys? Click here to contact us now. Aligning the MSA With Day-to-Day Operations The MSA should clearly identify the services the DSO will provide, such as billing, human resources, accounting, procurement, information technology, marketing, and facilities management. But the parties should also understand how those services will actually be delivered, including such granular but critical matters as: Who must approve expenditures Who hires and terminates nonclinical employees Who controls the practice's bank accounts Who manages payer enrollment and credentialing Who owns the patient records and other data Who is responsible for regulatory compliance Ambiguity can lead to disputes, particularly when the parties have different expectations about the DSO's role. A well-drafted MSA should be supported by practical integration procedures that translate contractual provisions into everyday operations. Employee and Staffing Integration The practice owner and the DSO may be the only parties with their signatures on an MSA, but the document also plays a big role in the fate and future of the practice’s employees. Compensation structures, benefits, payroll systems, timekeeping, job responsibilities, and reporting relationships may all change. Before integration, the parties should determine whether employees will remain employed by the professional practice, become employees of another affiliated entity, or transition under another arrangement permitted by applicable law. Counsel should also carefully review existing employment agreements and restrictive covenants to ensure that those documents are not in conflict with any relevant provisions of the MSA. Another common issue is the integration of compensation systems. A DSO may use standardized compensation models, bonus structures, or productivity metrics that differ from those historically used by the practice. Those changes should be reviewed not only for employment-law considerations but also for potential implications under healthcare fraud-and-abuse laws and applicable fee-splitting restrictions. Technology, Data, and Patient Records The technological infrastructure of a dental practice is complex enough on its own, but integrating its practice-management software, electronic records platform, accounting system, or communication tools to systems used throughout the DSO takes that complexity — and related risks — to another level. Patient records must remain accurate and accessible, and the parties must address applicable HIPAA privacy and security obligations when patient information is transferred, accessed, or stored by DSO personnel and vendors. The integration plan should address data ownership, access rights, cybersecurity responsibilities, backup procedures, retention requirements, and procedures for responding to security incidents. A rushed technology conversion can disrupt patient care and lead to costly but avoidable compliance problems. Branding and Patient Relationships DSOs frequently seek to standardize branding, marketing, websites, telephone systems, and patient communications. While consistency can be valuable, practices should consider how these changes affect existing patient relationships. Patients may be confused if a familiar practice suddenly adopts a new name, website, phone number, or communication style. The integration plan should provide a thoughtful transition that explains changes without undermining patient confidence. Counsel should also review marketing materials for compliance with applicable advertising rules. Dental practices remain subject to professional obligations even when a centralized DSO team manages marketing and communications. Financial Integration and Revenue Cycle Management Another major integration issue is the transition to the DSO's accounting and revenue-cycle systems. Differences in billing procedures, collection policies, payer relationships, and financial reporting can produce surprises after closing. The parties should establish clear procedures for accounts receivable, refunds, patient balances, insurance claims, write-offs, and reconciliation. They should also determine how financial information will be reported to the practice and its owners. These issues are especially important where the selling dentist continues to own the professional entity or retains an economic interest in its operations. Consider and Address Practical Integration Issues Before Closing It’s one thing for a newly cohabitating couple to combine their kitchenware, furniture, and checking accounts; it’s quite another to merge two operationally complex, heavily regulated, and technologically dependent businesses with each other. Perhaps the most important lesson is that dental practice/DSO integration should not be treated simply as a matter of documentation or an administrative project that begins after the transaction closes. It should be part of the transaction planning process. Before closing, the parties should identify critical systems, personnel, vendors, contracts, licenses, payer relationships, technology platforms, and regulatory requirements. They should establish an integration timeline and assign responsibility for each major task. The parties must ensure that the legal structure, MSA, operational procedures, technology, employment arrangements, and clinical responsibilities work together. For dentists selling to or partnering with a DSO, experienced legal counsel can help identify integration risks before they become post-closing problems. If you are considering selling your dental practice to a DSO, please call Grogan Hesse & Uditsky at (630) 833-5533 or contact us online to arrange for your free initial consultation. We Focus on You So You Can Focus on Your Patients At Grogan, Hesse & Uditsky, P.C., we focus a substantial part of our practice on providing exceptional legal services for dentists and dental practices, as well as orthodontists, periodontists, endodontists, pediatric dentists, and oral surgeons. We bring unique insights and deep commitment to protecting the interests of dental professionals and their practices and welcome the opportunity to work with you. Jordan Uditsky, an accomplished businessman and seasoned attorney, combines his experience as a legal counselor and successful entrepreneur to advise dentists and other business owners in the Chicago area. Jordan grew up in a dental family, with his father, grandfather, and sister each owning their own dental practices, and this blend of legal, business, and personal experience provides Jordan with unique insight into his clients’ needs, concerns, and goals.
By Jordan Uditsky • October 21, 2026
Respect My Authority: How Dental Practice Owners Can Preserve Clinical Autonomy After a Sale to a DSO Over the past several years, we have posted many articles on this blog discussing two particular topics: selling a dental practice to a dental service organization (DSO), and developments related to the corporate practice of dentistry by DSOs that stick their noses too much into a practice’s clinical operations and decision-making. At the center of the venn diagram linking these two issues is a concern that faces most dental practice owners when considering a sale to a DSO: how to maintain clinical autonomy and authority after a sale and prevent the DSO from interfering in this fundamental, non-administrative aspect of running a dental practice. While legislators and regulators debate about appropriate guardrails to put on DSOs to prevent their overreach into a dentist’s clinical responsibilities, it ultimately falls on the dental practice owner — and their counsel — to take the steps needed during negotiations to ensure that the documents governing the transaction include robust protections to preserve the dentist’s appropriate authority over clinical decisions. Are you interested in speaking with one of our attorneys? Click here to contact us now. Make Clinical Independence Explicit and Detailed in Writing One of the most important protections is an unequivocal contractual statement that clinical decisions remain under the licensed dentist's control. The purchase agreement, employment or professional services agreement, and other transaction documents should clearly distinguish between business decisions and clinical decisions. As with any contract, vagueness or lack of defined terms can plant the seeds of misunderstanding and conflict. Accordingly, a general promise that the dentist will maintain “clinical autonomy” without delineating what that actually means in practice is insufficient. The agreement should define what that autonomy means and identify decisions that cannot be dictated by non-clinical personnel, including, but not limited to: · Diagnosis · Treatment planning · Selection of appropriate treatment · Referrals · Patient communications concerning treatment · Prescribing · Use of clinical techniques and materials. Additionally, a dentist should consider provisions stating that treatment recommendations will be based on the patient's clinical needs and the dentist's independent professional judgment, rather than production targets, revenue goals, or other financial considerations. Establish Appropriate Limits on DSO Authority One of the main value-adds of selling to a DSO is that they typically assume responsibility for administrative services, including billing, scheduling, human resources, procurement, marketing, information technology, and facilities management. While many of these functions are easily distinguishable from clinical ones, there are areas where operational decisions could indirectly affect clinical care, such as scheduling policies, staffing levels, supply purchasing, laboratory arrangements, appointment lengths, and production incentives, all of which can have clinical implications. As such, the agreements should establish a clearly defined, workable boundary: the DSO manages the business, while the dentist retains authority over professional judgment. Compensation and Incentive Structures Can Pit Clinical Judgment and Business Objectives Against Each Other Compensation is another area that can create tension between a DSO’s business objectives and a dentist’s clinical judgment. Counsel should review an employment or services agreement to determine whether compensation formulas, production requirements, bonuses, quotas, or other incentives could pressure the dentist to recommend or perform treatment that the dentist would not otherwise recommend. That does not mean every production-based compensation arrangement is inappropriate. Rather, dentists should understand exactly how the formula works and consider contractual language confirming that compensation will not be contingent on making a particular clinical recommendation or on performing treatment the dentist does not believe is appropriate. One-Size-Fits-All Clinical Policies v. Individual Clinical Decisions Many DSOs have standardized policies that affect clinical practice which should be reviewed and addressed before closing. During due diligence and contract negotiations, practice owners and their counsel should understand the DSO's policies involving treatment protocols, referrals, supplies, laboratories, prescribing, infection control, scheduling, patient communications, and quality assurance. Such policies should allow appropriate clinical judgment where patient circumstances warrant an individualized approach, and the parties should establish how legitimate clinical exceptions will be handled. Clinical Autonomy Is Not a Set-It-and-Forget-It Issue The signing of documents at the consummation of a sale to a DSO may be the end of one process, but it is also marks the start of the actual, functioning relationship between the DSO and now-former practice owner. And that relationship can evolve over time in ways that can impact clinical autonomy. Another company may acquire the DSO; the practice could be transferred to another affiliated entity; and other management changes can alter or threaten the carefully negotiated dynamic reflected in the underlying agreements. Those agreements should address whether clinical-independence provisions survive such events and, where appropriate, whether they bind successors and affiliated entities. Selling a dental practice does not necessarily mean surrendering professional judgment. But clinical autonomy should not be left to assumptions, informal assurances, or legislators or regulators. It should be addressed explicitly in the transaction documents by sellers and their counsel. By doing so, dentists can reap the benefits of a DSO sale while retaining control over the one thing that no corporation or entity can or should: the practice of dentistry. If you are considering selling your dental practice to a DSO, please call Grogan Hesse & Uditsky at (630) 833-5533 or contact us online to arrange for your free initial consultation. We Focus on You So You Can Focus on Your Patients At Grogan, Hesse & Uditsky, P.C., we focus a substantial part of our practice on providing exceptional legal services for dentists and dental practices, as well as orthodontists, periodontists, endodontists, pediatric dentists, and oral surgeons. We bring unique insights and deep commitment to protecting the interests of dental professionals and their practices and welcome the opportunity to work with you. Jordan Uditsky, an accomplished businessman and seasoned attorney, combines his experience as a legal counselor and successful entrepreneur to advise dentists and other business owners in the Chicago area. Jordan grew up in a dental family, with his father, grandfather, and sister each owning their own dental practices, and this blend of legal, business, and personal experience provides Jordan with unique insight into his clients’ needs, concerns, and goals.
By Jordan Uditsky • October 14, 2026
With Recently Introduced Bill, Congress Enters the Corporate Practice of Medicine/Dentistry Fray. How Would It Impact Dental Practices and DSOs?
Show More