AI for Dentists in 2026: X-Rays, Perio Notes and the HIPAA Line

AI can already mark suspected caries on a bitewing, chart perio readings by voice, verify benefits and answer a dental office's phones. It can't diagnose for you, and no tool should touch patient data until its vendor has signed a business associate agreement. The diagnosis, the treatment plan and the chart remain yours.

Picture the day: a hygienist calling out six-point readings with no free hand, a benefits breakdown that came back wrong, a voicemail about a broken crown left at 7 p.m. Dental AI now reaches each of those, usually through software built for the operatory or the front desk. Because nearly all of it handles patient records, the contract question below comes first, ahead of features and price.

Before any demo: will the vendor sign a business associate agreement?

Any AI vendor that creates, receives, maintains or transmits patient information for your practice is a business associate under HIPAA, and you need a signed agreement before the data moves. The federal definitions cover a provider who sends health information electronically in connection with a covered transaction, as an office filing electronic claims does. The Privacy Rule then lets you share protected health information (PHI) with a business associate only after you get satisfactory assurance that it will safeguard the information.

Three points from HHS catch practices out when they try new software:

• Skipping the agreement is your violation. HHS says a covered entity that uses a cloud provider to process or store PHI without an agreement is in violation of the HIPAA Rules.
• Encryption doesn't remove the need. A provider holding only encrypted PHI, with no decryption key, is still a business associate.
• A signature doesn't finish the job. HHS's cloud computing guidance expects you to understand the vendor's environment well enough to run your own risk analysis.

What that rules out on an ordinary Tuesday

Pasting a claim narrative into a chatbot is the usual slip. Stripping the name doesn't make it safe, because the de-identification rule also lists dates directly related to the patient (other than the year), phone numbers, email addresses and full-face photos, among other identifiers. A narrative with a date of service still carries one.

General tools have their own limits. OpenAI's help pages say it doesn't offer an agreement for ChatGPT Business, and list routes through sales-managed Enterprise and Edu accounts, ChatGPT for Healthcare, and a flow for eligible individual clinicians, each limited to listed products and features. Google says Workspace customers without a signed agreement must not use PHI in those services, and that its agreement doesn't cover third-party apps or add-ons. So an AI add-on connected to a covered Gmail account needs its own agreement.

Reading radiographs: what the FDA cleared, and for whom

FDA clearance for dental imaging AI is specific to the image type, patient age and findings, so a marketing line saying "FDA-cleared" doesn't answer whether a tool covers your case. Two records for Pearl, a dental AI vendor, show how narrow the wording gets:

• Second Opinion, bitewing and periapical. The FDA 510(k) clearance record shows a decision on March 4, 2022. Its summary describes software that marks suspected caries, margin discrepancies, calculus and periapical radiolucency, on permanent teeth in patients 12 or older, as a second reader.
• Second Opinion Panoramic. The record shows a decision on November 14, 2025. Its summary covers panoramic radiographs of permanent teeth in patients 16 or older.

"Second reader" has a practical meaning: you read the film, then look at what the software marked. Caries Assist, from the vendor Overjet, was announced as detection and outlining software for chairside aid and patient communication in May 2022. Overjet's home page calls its Vision AI FDA-cleared without giving clearance numbers or scope, so ask for the 510(k) number behind each finding you plan to rely on.

Treat accuracy and revenue figures as sales claims until someone outside the company has tested them. Pearl's home page advertises 37% more disease caught and 30% more treatment acceptance. The American Dental Association's AI standards page describes Technical Report No. 1109:2025, which argues for an independent dataset, held by a third party that makes no AI products, to compare these tools. The same page lists ANSI/ADA Standard No. 1110-1:2025 on annotating and collecting data from 2D radiographs. The ADA page offers no clinical instructions, so it won't tell you which tool to trust.

Perio readings and SOAP notes by voice

Voice charting solves a problem specific to the operatory: the person probing has no free hand and may have no assistant. Bola AI's Voice Perio captures probing depths, recession, bleeding, suppuration, mobility and furcation by voice, writes into Dentrix, Eaglesoft, Open Dental and Dentrix Ascend, and links a business associate agreement and a patient consent form from its product page.

Ambient note tools go further. Pearl Voice transcribes the patient conversation into structured SOAP notes with templates for more than 30 clinical scenarios and writes back to the practice management system; its page doesn't say whether a clinician must review a note before it is final, so ask. Overjet's Voice AI suite describes automated charting and visit summaries.

The front desk: benefits, phones and Yelp replies

Front-desk AI splits into three jobs, and each vendor needs its own agreement because each handles patient names, schedules or coverage. Prices and claims below were on the vendors' sites in November 2026.

Ask each phone vendor how it writes back to your practice management system, and test a real scenario: a toothache caller at 7 p.m. who needs a person, not a booking link.

Review replies have already cost a dental practice money. Elite Dental Associates in Dallas paid $10,000 in 2019 after HHS's Office for Civil Rights found it had disclosed patients' health information in replies to their Yelp reviews, and that it had no policy on social media. A drafting tool would make that mistake faster. Use a reply that confirms nothing about whether the reviewer is a patient, whoever or whatever writes it.

Patient email is a separate question, and it's permitted with safeguards. HHS says providers may email patients about treatment if they take care with addresses and limit what's in an unencrypted message, and our encryption walkthrough for Apple Mail, Outlook and Gmail covers the mechanics.

Decisions that stay chairside

Dental AI assists a licensed clinician; the software marks and drafts, and the clinician decides. These stay with you, and nothing on this page is clinical or legal advice:

• The diagnosis. A mark on a bitewing is a prompt to look again. Pearl's FDA summary calls its software an aid to a professional's review.
• The treatment plan. Whether to watch an incipient lesion or restore it depends on the patient's history, risk and wishes, which the film doesn't show.
• Prescriptions and anesthesia. The O*NET profile of general dentists names both as core tasks, and neither belongs in a chat window.
• What the chart says. Your signature covers a scribe's wording as much as your own.
• Your state's rules. Ask your state dental board and malpractice carrier whether they have guidance before relying on a new tool.

The owner's side of the practice, where Merlin can and can't help

Merlin, the Gmail and Google Calendar assistant we make for Macs, should not be used with protected health information. Merlin's privacy policy and terms don't mention HIPAA or business associate agreements, and the policy says information needed to carry out a request may be sent to its AI providers. Merlin also reads the mail and calendar of any Google account you connect, so account choice decides what it sees.

• Don't connect a Gmail account that patients, labs, referring offices or insurers write to, or a calendar with patient names on it.
• Don't record a consult, a case discussion or a staff huddle about patients with Merlin's call recorder, and don't paste patient details into its chat.
• Don't expect phone answering, texting, charting, imaging, claims or any link to Dentrix or Open Dental. Merlin does none of that. Its email and calendar connection is also Google only, so an Outlook or Microsoft 365 office can't use it.

What's left is real work. The federal handbook entry on dentists says those in private practice handle bookkeeping and buying equipment and supplies, and employ hygienists, assistants, lab technicians and receptionists. That produces a business inbox with no patients in it: the CBCT service contract, the landlord's renewal, an associate candidate, the accountant, a CE registration. Kept on its own Google account, that mail is where Merlin fits.

• Who's waiting. The Needs you list in Merlin's People panel names anyone whose direct email has waited between 2 and 30 days for your answer, such as the candidate you meant to answer between patients. Phone calls don't count, so a supplier you've already rung can still appear.
• Replies you check first. Ask in chat to answer the equipment rep, and a card holds the draft; edit it, and it stays unsent without your yes. Routines, tasks you set Merlin to run on a timer, skip that step and can send email with no card if you allow it, so use them only for summaries to yourself.
• Briefs before a call. Shortly before an event on that calendar, a Meeting Brief pulls earlier threads and commitments, useful before a practice broker or your accountant calls.
• Business calls. Merlin's recorder works on every plan, with transcripts on paid ones. The audio remains on that Mac until it's sent for transcription, and transcripts sit with your Merlin account, so keep this to calls with no patient details, with the other party's consent.

If the books are the bigger headache, see AI for bookkeepers for what your bookkeeper's tools now do. For meetings outside the operatory, we compare AI note takers.

Vetting one dental AI tool this month

One tool tested properly teaches you more than five demos.

1. Ask your team what's already in use. Include personal chatbot accounts. Find out what patient information has gone into them, and talk to your HIPAA or privacy lead about anything you find.
2. Start with your existing software. Ask your practice management and imaging vendors what AI is included, and whether your current agreement covers it.
3. Get the paperwork before the demo data. Request the signed agreement, the 510(k) number for each imaging finding, and how the tool writes into your charts. Use no real patient data until the agreement is signed.
4. Pilot with your own read first. For radiograph AI, read a set of bitewings yourself, then compare. Log where you and the software disagree, and which you'd act on.
5. Write it down. Add the tool to your risk analysis, and write a one-page policy on which tools staff may use, who reviews output, and how the office answers online reviews.