The Dental Office Compliance Checklist (Daily, Weekly, Quarterly, Annual)

A dental office compliance checklist covers three sets of rules at once: OSHA's workplace-safety standards, the CDC's infection-control guidance (weekly spore testing, waterlines at ≤500 CFU/mL), and your state dental board's rules. This version is organised by cadence (daily, weekly, monthly, quarterly, annual and on-event), so each item lands on the day it's due, with the record an inspector would ask for and a link to the source.

Written by Kellie Thimmes, Director of Education · Reviewed by Javier Lozano · Published 22 September 2026 · Updated 22 September 2026

If compliance landed on your desk as a side duty (office manager, the assistant who became the infection-control coordinator, the dentist whose name is on the licence), the checklists you've found were probably lists of regulation numbers. They say what the rules are, not what to do on a Tuesday. This one does, and it's the only one we've found that puts waterline and spore testing on the same page as the OSHA binder.

On this page: Why cadence? · Daily · Weekly · Monthly · Quarterly · Annual · On-hire and on-event · Who inspects? · What they ask for · Fines · Review cadence · Who owns it · What the data says · Where it lives · FAQ · Sources

Why is this checklist organised by cadence instead of by regulation?

Because inspectors ask by regulation, but your team works by calendar. Most published checklists are organised by CFR number, which is useful for an audit and useless for scheduling. You already run the practice on intervals (hygiene recalls at six months, not "by diagnosis") and compliance behaves the same way. Every row below gives what "done" looks like, the record to keep, and a numbered link to the OSHA, CDC or state source; where an item is best practice rather than a rule, we say so.

Two glosses first. OSHA (Occupational Safety and Health Administration) protects your employees, not your patients. The CDC (Centers for Disease Control and Prevention) writes the infection-control guidance that protects patients; it doesn't enforce, but state dental boards increasingly adopt its guidance as law.

The whole checklist on one wheel: daily at the centre, annual near the rim, and an outer ring that fires on a trigger rather than a date. The tables below carry the record to keep and the source for every item.

Daily

Item	What "done" looks like	Record to keep	Source
Flush dental unit waterlines	20-30 s between patients; longer purge at start of day (California: 2 min)	None federally; written protocol in CA	[12], [19]
Waterline treatment in use	Continuous treatment (tablet, straw or cartridge: BluTab, ICX, Citrisil, Sterisil, DentaPure, BluTube) used exactly per its instructions for use (IFU)	Treatment log: product, lot, operatory, date, initials	[12], [13]
Sterilizer load monitoring	Mechanical readings (time, temperature, pressure) every cycle; chemical indicator in every package	Load log: sterilizer ID, cycle, result, operator	[12], [13]
Sharps and regulated waste	Sharps containers closable, puncture-resistant, labelled, replaced before overfilling; waste red-bagged and hauled per your state medical-waste rule	Hauler manifests	[3]
PPE, hand hygiene, surfaces	Gloves, masks, eye protection, gowns worn for exposure-prone tasks; barriers changed and surfaces disinfected between patients for the product's full contact time	None (visual); product IFU on file	[3], [5], [12]

Weekly

Item	What "done" looks like	Record to keep	Source
Spore test every sterilizer	A biological indicator (BI, the spore test) run at least weekly in each sterilizer with a matching control, read after full incubation, and in every load containing an implantable device (Maryland: per the sterilizer IFU, since 19 January 2026 [17])	BI log: sterilizer ID, date, lot, test and control results, initials; corrective action if positive	[12], [13]
Eyewash check	Plumbed units activated and flushed; self-contained units checked for fluid date and seal	Eyewash log	[8]
Sterilizer cleaning	Chamber, gasket, trays and reservoir cleaned per the sterilizer IFU (most say weekly)	Maintenance log	Manufacturer IFU; [12]

Monthly

Item	What "done" looks like	Record to keep	Source
Fire extinguishers	Visual check: pin, gauge in the green, no damage	Initial and date on the tag	[7]
Emergency kit and oxygen	Drug expiry dates, oxygen cylinder pressure and regulator, AED pads and battery	Emergency equipment log	State dental board rule (varies). Texas, for example, requires a working positive-pressure breathing apparatus with oxygen plus the other emergency equipment and dated drugs a prudent dentist would keep, 22 TAC §108.7(5) [23]
Sharps injury log	Any needlestick or splash logged (device type and brand, work area, how) and post-exposure follow-up complete	Sharps injury log; confidential medical record	[3]
Safety Data Sheets	Every chemical in inventory has a current SDS (Safety Data Sheet) on file; retired products removed; new ones trained before first use	HazCom program with SDS index	[4]

Quarterly

Item	What "done" looks like	Record to keep	Source
Test dental unit waterlines	Every operatory tested (pooled samples of up to 10 lines where your state allows); result ≤500 CFU/mL (colony-forming units per millilitre). CDC says test per the manufacturer's IFU; Georgia and Washington set quarterly as the floor. New or recently failed lines: monthly until two consecutive passes	Lab report or in-office log: operatory, date, tester, result	[13], [14], [18]
Shock waterlines	High-concentration shock per your treatment product's and dental unit's IFUs; ProEdge's protocol is quarterly and after any failed test	Shock log: product, concentration, contact time, operatory, date	Product IFU; our shock guide
Walk this checklist	15-minute self-inspection; note gaps and owners	Dated walkthrough	Best practice (no rule requires it)

Annual

Item	What "done" looks like	Record to keep	Source
Bloodborne pathogens (BBP) training	Every employee with occupational exposure trained within a year of the last session, with time for questions	Training record: date, content, trainer and qualifications, attendees; kept 3 years	[3]
Exposure Control Plan (ECP) review	Reviewed and updated at least annually, including the safer-sharps devices considered and the frontline staff consulted	Dated ECP with revision history	[3]
Hepatitis B status	Vaccination or signed declination on file for every exposed employee	Employee medical file (employment + 30 years)	[3]
Hazard Communication (HazCom) program	Written program current; containers labelled; training refreshed when new hazards appear	Written program; training records	[4]
PPE hazard assessment	Written, certified assessment of which tasks need which PPE	Signed certification	[5]
Emergency Action Plan (EAP)	Exits, alarms and roles confirmed; written if you have more than 10 employees	Written EAP (or documented oral briefing for ≤10 staff)	[6]
Fire extinguisher maintenance	Annual maintenance by a qualified service	Maintenance record (kept 1 year)	[7]
Radiation	X-ray equipment registered and inspected on your state's schedule; dosimetry where required	Registration certificate; dosimetry reports	[9]; state radiation-control agency
HIPAA pointer	Workforce privacy and security training documented; risk analysis reviewed	Training records and policies, kept 6 years	[21]
Licences and CE	Every licence, permit and CPR/BLS card current; state infection-control CE done (Georgia: 2 hours on infection control, including dental unit water lines)	Copies of licences and CE certificates	[15]; your state board
Records-retention audit	You can produce 5 years of waterline logs (Georgia, Washington), 3 years of training records, 30 years of medical records, 6 years of HIPAA documentation; OSHA poster displayed	Retention schedule	[2], [3], [14], [18], [21]

On-hire and on-event

Trigger	What "done" looks like	Record to keep	Source
New hire with exposure risk	BBP and HazCom training at initial assignment; hepatitis B vaccine offered within 10 working days; PPE fitted	Training records; Hep B form	[3], [4], [5]
Exposure incident (needlestick, splash)	Immediate post-exposure evaluation per the ECP; sharps injury log entry	Sharps log; confidential medical record	[3]
Failed spore test	Sterilizer out of service; procedure reviewed; retest with a control; if the retest is positive, recall loads back to the last negative; see our failed spore test protocol	BI log with corrective action	[12]
Failed waterline test (>500 CFU/mL)	Shock, retest until passing; Georgia requires "immediate remedial action"	Result, remediation, retest	[14], [18]
Plumbing work or a new dental unit	Retest: Washington at 5-10 days and again at 21-28 days; Georgia within 30 days	Test results	[18], [14]
Sterilizer repaired or relocated	BI test before it returns to service	BI log	[12]
Serious injury	Fatality reported to OSHA within 8 hours; in-patient hospitalization, amputation or eye loss within 24 hours, even for offices exempt from the 300 log	Report confirmation	[10]
Opening or changing ownership (Maryland)	Owner designates a licensed supervising dentist, registered with the Board, responsible for infection control	Board registration, displayed	[16]

Who inspects a dental office?

Three agencies, for three different reasons, wanting overlapping but not identical paperwork. This is the part most checklists skip.

Who	What they enforce	What brings them in	What they ask for
OSHA (or your state plan: Cal/OSHA, Washington's WISHA, others)	Employee safety: BBP, HazCom, PPE, EAP, fire, eyewash, radiation, the General Duty Clause [11]	Employee complaints, referrals, a reported hospitalization; rarely random	ECP, training records, SDS, sharps log, Hep B forms, PPE assessment
State dental board	Your licence, and increasingly the CDC guideline by reference: Maryland's COMAR 10.44.36 incorporates the 2003 guideline; Georgia's Rule 150-8-.05 sets quarterly waterline testing [14], [17]	Patient complaints, renewal, and, in Maryland since 18 August 2025, an unannounced inspection on a written, signed complaint, including a referral from the Commissioner of Labor and Industry [17]	Sterilization and spore-test logs, waterline results and treatment logs, CE certificates, written protocols
HHS Office for Civil Rights (OCR)	HIPAA privacy and security [21]	Breach reports, patient complaints	Policies, training records, risk analysis

The distinction that matters: OSHA doesn't care whether your waterlines pass, and your dental board doesn't care whether your SDS binder is alphabetised. An office can be spotless on one axis and exposed on the other. Maryland shows where this is heading: a workplace-safety complaint can now trigger a dental-board infection-control inspection, with 30 days to correct [17]. Georgia's board asks for five years of waterline logs [14]. California's §1005 rewrite went back to a working group in February 2025 and hadn't been adopted as of 25 August 2026 [20].

What do inspectors actually ask for?

Documents first, then a walk-through. If you can produce these in under ten minutes, most of the anxiety goes away:

• Exposure Control Plan, reviewed within 12 months; BBP training records (3 years); Hep B forms; sharps injury log [3]
• HazCom program and an SDS for every chemical on site [4]; PPE hazard assessment [5]
• Emergency Action Plan; fire-extinguisher tags; eyewash log [6], [7], [8]
• Sterilization logs: per-load mechanical and chemical results, weekly BI results with controls, and what you did about any positive [12], [13]
• Waterline test results, treatment and shock logs, 5 years' worth in Georgia and Washington [14], [18]
• Sterilizer and X-ray registrations; dosimetry if applicable [9]
• Licences, permits, CPR cards and CE certificates, including state infection-control hours [15]
• Emergency kit and oxygen log; HIPAA policies, training records and risk analysis [21]

The house rule applies: if it isn't documented, it didn't happen. Not because inspectors are unreasonable, but because a log is the only evidence that exists after the fact.

What are the fines for a dental office in 2026?

As of OSHA's memorandum of 21 May 2026, the federal maximums are $16,550 per serious or other-than-serious violation, $165,514 per willful or repeated violation, and $16,550 per day for failure to abate [1]. They're unchanged from 2025: the inflation adjustment didn't happen because the Bureau of Labor Statistics couldn't produce the October 2025 CPI figure during the government shutdown [1]. The same memo widened the small-employer reduction to 80 percent for employers with 20 or fewer employees, so a single-location practice rarely sees the headline number [1]. State-plan states set their own maximums.

Dental boards work through the licence instead: reprimand, statutory fines, probation, mandatory CE, or suspension. Maryland gives 30 days to correct before re-inspection [17]. HIPAA penalties come from OCR on a separate scale; we point to them without pretending this is a HIPAA guide.

Two things worth holding onto. Most citations in dental offices are for documentation that lapsed, not for anyone getting hurt [2]. And a lapsed record is what happens when one person carries eleven cadences in their head, not a character flaw. The fix is a calendar.

How often should you review the checklist?

Quarterly for the walk-through, annually for the full review, and immediately on any trigger. The quarterly walk sits beside the waterline tests; the annual review sits beside BBP training and the ECP update, which OSHA already requires you to date [3]. Triggers are in the on-event table. Two rules changed recently (Georgia's waterline rule on 20 July 2025 [14] and Maryland's infection-control regulations on 19 January 2026 [17]), which is why every row above carries a dated source.

Who owns the checklist?

Somebody named, not "the front desk." The CDC's 2016 Summary recommends that every practice assign at least one person as its infection prevention coordinator [13], [22]; most offices call that person the infection-control coordinator (ICC). Maryland made it law: every private dental office designates a licensed supervising dentist, registered with the Board, responsible for all infection-control activities (HB 499, Chapter 905, effective 1 October 2024) [16]. The workable split: the dentist-owner holds the liability, the ICC runs the calendar, and every row has an initial next to it. Our Infection Control Coordinator playbook covers the role in depth.

What does the data say?

The quarterly waterline row is the one where our own lab has the numbers, so it is worth pausing on.

Treated is not the same as passing. In 2017 ProEdge analysed 22,196 consecutive dental unit waterline tests, the largest treatment-efficacy dataset in dentistry at the time. Of the treated waterlines, 31% failed the ≤500 CFU/mL standard. Straws and cartridges passed about 72% of the time; shock-only and daily-liquid protocols passed 60% or less; and no treatment product without an accompanying shock passed above 90% [24]. That is why the test sits on the calendar and not just the tablet in the bottle. ProEdge will publish updated figures in the annual State of Dental Water report.

The practical reading: a treatment product in every operatory is the daily row, not proof. The quarterly test is the only line on this checklist that tells you whether the daily row is working.

Where does the checklist live?

Three honest options. A paper binder works, and thousands of well-run offices use one; its weakness is that the tick and the evidence live in different places, so "show me the result" means a second search. A generic task tool (OnTraq, Done Desk, or a shared spreadsheet) reminds people and records that a task was ticked, not what the result was. Clear™, ProEdge's compliance dashboard, is the third: the checklist lives there with your actual waterline and spore-test results attached to each item, so the record is the result itself, and the reminders follow the cadences on this page. It works with whatever treatment product or sterilizer you already use. For the two lab-driven rows, the printable Waterline Maintenance SOP and Sterilization Monitoring Log in our toolkit library work with any of the three. Pick the one your team will keep up; the best checklist is the one that's current on the day someone asks for it.

Frequently asked questions

What does OSHA look for at a dental office?

Mostly paper and habits. An OSHA compliance officer will ask for your written Exposure Control Plan (dated within the last year), bloodborne-pathogens training records, hepatitis B vaccination or declination forms, the sharps injury log, your Hazard Communication program with Safety Data Sheets, and proof that PPE, eyewash and fire extinguishers are in place and checked. Then they walk the office and compare what's written to what's happening.

What is the most common OSHA violation in dental offices?

For NAICS 621210 (Offices of Dentists), the two standards cited most often are Bloodborne Pathogens (29 CFR 1910.1030) and Hazard Communication (29 CFR 1910.1200). In practice that means a missing or out-of-date Exposure Control Plan, training that wasn't documented, and Safety Data Sheets that don't match the products on the shelf. None of these are clinical failures; they're paperwork that lapsed while everyone was busy treating patients.

What documents do I need for a dental office inspection?

Keep one binder (or one dashboard) with: the Exposure Control Plan, BBP and HazCom training records, Hep B forms, the sharps injury log, Safety Data Sheets, the PPE hazard assessment, the Emergency Action Plan, fire-extinguisher tags, eyewash log, sterilization logs with weekly spore-test results, waterline test results with treatment and shock logs, sterilizer and X-ray registrations, current licences and CE certificates, the emergency-kit log, and HIPAA policies and training records.

How often should a dental office review its compliance checklist?

Walk the whole checklist quarterly, when the waterline tests come due, and do a full review once a year alongside the annual Exposure Control Plan update and BBP training. Then review the affected section any time something changes: a new hire, a new sterilizer or dental unit, a new chemical product, plumbing work, a failed test, or a new state rule such as Georgia's July 2025 waterline rule or Maryland's January 2026 infection-control regulations.

What are the OSHA fines for a dental office in 2026?

As of OSHA's 21 May 2026 memo, the maximums are $16,550 per serious or other-than-serious violation, $165,514 per willful or repeated violation, and $16,550 per day for failure to abate. There was no inflation increase for 2026 because the October 2025 CPI data was never produced during the government shutdown. Employers with 20 or fewer employees can qualify for penalty reductions of up to 80 percent. State-plan states set their own figures.

Does OSHA apply to a small dental office?

Yes. Any dental office with at least one employee is covered by the OSH Act. What changes with size is paperwork: offices of dentists (NAICS 6212) are partially exempt from keeping the OSHA 300 injury log, and an office with 10 or fewer employees may communicate its Emergency Action Plan orally instead of in writing. Every office must still report a work-related fatality within 8 hours and an in-patient hospitalization, amputation or eye loss within 24 hours.

Is an infection control coordinator required in a dental office?

The CDC's 2016 Summary recommends that every dental practice assign at least one person as its infection prevention coordinator, and many state boards have built on that. Maryland now requires every private dental office to designate a registered supervising dentist who is responsible for all infection-control activities (HB 499, effective 1 October 2024). Whatever your state calls it, someone has to own the calendar; this checklist is what they run.

How long does a dental office need to keep compliance records?

It depends on the record. OSHA BBP training records: 3 years. Employee medical records, including exposure incidents: the length of employment plus 30 years. Fire-extinguisher maintenance records: 1 year. HIPAA policies and training documentation: 6 years. Waterline testing and maintenance logs: 5 years in Georgia and Washington, and 5 years is a sensible default anywhere. Sterilization logs: check your state board rule; many practices default to 5 years to match.

Sources

1. OSHA, 2026 Annual Adjustments to OSHA Civil Penalties (memorandum) (2026-05-21)
2. OSHA, Dentistry: Standards (accessed 2026-08-25) (2026-08-25)
3. 29 CFR 1910.1030, Bloodborne Pathogens (2001-01-18)
4. 29 CFR 1910.1200, Hazard Communication (2024-05-20)
5. 29 CFR 1910.132, Personal Protective Equipment, General Requirements (2016-11-18)
6. 29 CFR 1910.38, Emergency Action Plans (2002-11-07)
7. 29 CFR 1910.157, Portable Fire Extinguishers (2013-01-01)
8. OSHA standard interpretation, ANSI Z358.1 as guidance for complying with 1910.151(c) (2002-04-18)
9. 29 CFR 1910.1096, Ionizing Radiation (1996-06-20)
10. 29 CFR 1904.2 and Appendix A to Subpart B, Partial exemption for establishments in certain industries (NAICS 6212, Offices of Dentists) (2015-01-01)
11. OSH Act of 1970, Section 5(a)(1), General Duty Clause (1970-12-29)
12. CDC, Guidelines for Infection Control in Dental Health-Care Settings, 2003 (MMWR 52(RR-17)) (2003-12-19)
13. CDC, Summary of Infection Prevention Practices in Dental Settings: Basic Expectations for Safe Care (2016-10-01)
14. Georgia Board of Dentistry, press release: Board adopts rule on dental unit water quality (Rule 150-8-.05, effective 20 July 2025) (2025-08-29)
15. Georgia Board of Dentistry, Rule 150-3-.09, Continuing Education for Dentists (infection-control hours incl. dental unit water lines) (2024-01-01)
16. Maryland General Assembly, HB 499 (2024), Health Occupations: Private Dental Offices, Infection Control (Ch. 905) (2024-05-16)
17. Maryland Division of State Documents, COMAR 10.44.34 Inspections: Compliance with CDC Guidelines (effective 18 August 2025, 52:16 Md. R. 847) and COMAR 10.44.36 Private Dental Offices: Infection Control (effective 19 January 2026, 53:1 Md. R. 23) (2026-01-19)
18. WAC 246-817-660, Dental unit water quality (Washington) (2021-01-23)
19. 16 CCR § 1005, Minimum Standards for Infection Control (California) (2019-01-01)
20. Dental Board of California, Board meeting minutes, February 6-7, 2025 (§1005 proposal referred back to working group) (2025-02-07)
21. 45 CFR 164.530, HIPAA Privacy Rule administrative requirements (training §164.530(b); documentation retention §164.530(j)) (2013-01-25)
22. American Dental Association, Infection Control and Sterilization (Oral Health Topics) (2022-10-05)
23. 22 Tex. Admin. Code §108.7, Minimum Standard of Care, General (paragraph (5), office emergencies) (2022-06-02)
24. ProEdge Dental, Dental Water Treatment Product Selection Guide (2017 analysis of 22,196 consecutive dental unit waterline tests) (2018-03-01)