Dental Sterilization Compliance Requirements by State

Frequently asked questions

How often do dental sterilizers need to be tested?

The CDC recommends weekly biological monitoring (spore testing) for every heat sterilizer — guidance that many states adopt into rule directly. Florida instead requires a test every 40 hours of use OR every 30 days for steam autoclaves. Arkansas requires a monthly minimum. Indiana requires a biological indicator within 7 days prior to a sterilizer’s current use — effectively weekly while in use, with a fresh test after an idle stretch.

How long do dental sterilization records need to be kept?

It varies dramatically by state. Washington requires 5 years, the longest explicit period we found. California requires 12 months; Ohio, Tennessee, and Louisiana require 2 years; Oregon, Georgia, Idaho, Arkansas, and Kansas require 3 years (Oregon and Idaho as calendar-year schemes). In several states we reviewed — including Texas, New York, Florida, Illinois, and Massachusetts — the rules state no retention period of their own. Where retention is unspecified, the ADA and many malpractice insurers recommend keeping sterilization records as long as business records generally, often 7 or more years.

Are paper sterilization logs acceptable, or do I need to go digital?

Both formats are widely accepted — in the state rules we reviewed, none forbids digital records or requires paper. The recurring functional requirement is that the records be "available for inspection on request" — paper, spreadsheet, or purpose-built software all qualify, provided they capture the required data points and can be produced when asked.

Who actually audits dental sterilization records?

In a private US dental practice, the agency that practically matters is usually the state dental board. OSHA has authority via the Bloodborne Pathogens Standard but rarely focuses on cycle logs specifically. The FDA regulates the sterilizers themselves but does not inspect practices. Inspections are typically complaint-driven — triggered by a patient complaint, an employee whistleblower, an alleged transmission event, or a Medicaid audit at participating practices. Some states go further: Iowa, for example, explicitly permits routine random inspections.

What happens if a biological indicator (spore test) fails?

A positive spore test means the sterilizer did not work for that cycle, and any instruments processed since the last passing test may be compromised. The response CDC guidance recommends: stop using the sterilizer, retest immediately, identify and quarantine affected loads, retest with a fresh BI, and document the entire event; if a second test also fails, take the device out of service until it can be repaired. Some states have written versions into rule — Tennessee requires removal from service after a second consecutive positive, and Arkansas adds recall and reprocessing of items handled since the last negative test. Cuspo records each step of this remediation workflow as you complete it.

What is an "infection control coordinator" and is one required?

The CDC recommends every dental practice designate an infection control coordinator (ICC) — a single staff member responsible for sterilization protocols, training, and compliance documentation. This is guidance rather than law unless a state adopts it: some states (e.g. California) name the role explicitly in rule, and many others incorporate the CDC guidelines by reference. Cuspo keeps the records an ICC is responsible for — cycle logs, BI results, and exports — current and in one place.