Dental Office Cybersecurity and HIPAA: A Practical Guide

Last reviewed: October 31, 2026

If your practice lost access to its schedule, patient charts, X-rays and treatment plans tomorrow morning, how long could you keep seeing patients? Many small dental offices cannot answer that with confidence. Cybersecurity is not only a technology issue. It determines whether you can treat patients, run the business and meet your legal duty to protect patient information.

This guide explains what HIPAA requires today, what is only proposed, and what practical steps a small practice can take. It uses three labels throughout:

• Current requirement: what the HIPAA rules say today.

• Recommended practice: sensible steps that are not legal mandates.

• Proposed: changes that have not become law.

This article is general information, not legal advice.

What would a cyberattack do to a dental practice?

Ransomware is malicious software that locks your files so you cannot open them, usually with a demand for payment. HHS states that "the presence of ransomware (or any malware) is a security incident under HIPAA".

For a dental office, the practical effects are easy to picture:

• You cannot see tomorrow's appointment schedule.

• You cannot open patient charts or treatment plans.

• X-rays and other images are out of reach.

• Staff fall back on paper and memory while patients wait.

Small practices are not exempt. Becker's Dental Review reported three dental organizations whose incidents affected 501, 13,300 and 11,273 individuals.

Does HIPAA apply to my dental practice, and what does it require today?

Current requirement. The HIPAA Security Rule applies to health care providers that transmit health information electronically in connection with certain standard transactions, as well as to their business associates, according to the HHS Security Rule summary. Practices that submit insurance claims electronically are typically covered. Confirm your status with your attorney.

The rule protects ePHI, which is patient health information stored or sent electronically. HHS describes the rule as "flexible, scalable, and technology neutral." It does not prescribe specific products. You choose measures based on your size, complexity, costs and the likelihood and severity of risks. It groups safeguards into three categories:

• Administrative: policies, training, an assigned security official, incident procedures, a contingency plan and business associate contracts.

• Physical: who can enter the facility, where workstations sit, and how devices and media are handled and disposed of.

• Technical: access control, audit logs, authentication and transmission security.

Some requirements are addressable, and encryption is one of them. "Addressable" does not mean optional. HHS explains that you must decide whether the measure is reasonable and appropriate, implement it if so, or implement an equivalent alternative if that is reasonable, and document your decision.

What changes are proposed, and are they law?

Proposed. On December 27, 2024, HHS's Office for Civil Rights issued a notice of proposed rulemaking to amend the Security Rule. The proposal would, among other things:

• require multi-factor authentication and encryption of ePHI at rest and in transit, with limited exceptions;

• require network segmentation and a technology asset inventory and network map;

• require written procedures to restore certain systems and data within 72 hours;

• require a compliance audit at least every 12 months, vulnerability scanning every six months and penetration testing every 12 months.

These are proposals. They are not current requirements, and the current Security Rule remains in effect. Rulemaking timelines can change, so this article does not predict when or whether a final rule will arrive.

What is a HIPAA risk analysis, and why isn't a scan enough?

A risk analysis is a structured review of how patient information could be lost, exposed or made unavailable, and what you will do about it. HHS's guidance on risk analysis describes steps that include:

1. Identifying where ePHI is stored, received, maintained or transmitted.

2. Identifying reasonably anticipated threats and the vulnerabilities they could exploit.

3. Assessing your current security measures.

4. Estimating the likelihood and impact of each risk.

5. Assigning risk levels, listing corrective actions and documenting the results.

A vulnerability scan or a device inventory feeds this process, but neither is the process. A real risk analysis also looks at people and processes (training, shared logins, vendor access), physical safeguards (who can reach the server room) and technical controls.

How often? HHS says the Security Rule does not specify a frequency. The process "should be ongoing," and it should be updated after events such as a security incident or planned new technology. Some organizations review annually, but that is a practice choice, not an HHS requirement.

Which problems should dental owners look for first?

Each issue below includes why it matters and a question for your IT provider.

Do several staff members share one login?

Shared accounts make it impossible to tell who opened a chart, and you cannot remove one person's access without disrupting everyone.

Current requirement: the Security Rule requires unique user identification, meaning a unique name or number for identifying and tracking user identity in systems that hold ePHI. Avoid shared accounts that prevent your practice from knowing who accessed information. How this applies can depend on the system and circumstances, so ask your provider to confirm how each of your systems handles it.

Recommended practice: turn on multi-factor authentication (MFA), which asks for a second proof of identity such as a code on a phone, for email, remote access and any other system that supports it. MFA would become a requirement under the proposed rule, but it is a recommended practice today. Also disable accounts promptly when staff leave.

Ask your provider: "Can you show me every account that can reach our practice-management system and imaging, and who each belongs to?"

Is older imaging equipment or software putting your network at risk?

Some equipment can no longer receive security updates, or updating it is costly or could break compatibility. Recommended practice: list these systems, ask each vendor about supported versions and update options, and record the risk in your risk analysis. For devices that cannot be updated, ask about limiting what they connect to. Separating devices onto their own sections of the network (segmentation) can reduce exposure, but it does not guarantee a problem will stay contained.

Ask your provider: "Which of our devices no longer receive security updates, and what is the plan for each?"

Who can connect to your systems remotely?

Practice-management vendors, IT providers and other third parties often connect from outside. Each connection is a doorway you need to know about.

Current requirement: some vendors that create, receive, maintain or transmit protected health information on your practice's behalf are business associates. When a vendor is a business associate, an appropriate written agreement is generally required. Review each vendor's role rather than assuming every vendor relationship is the same. See the HHS business associate guidance.

Recommended practice: keep a list of everyone with remote access, require individual sign-ins with MFA, and disable access that is not in use.

Ask your provider: "Who has remote access, how do they sign in, and how would we know when they connect?"

Do you have a backup, or have you proven you can restore it?

A backup is a copy. A proven restore means you have recovered real data from that copy and know how long it took. HHS states that "maintaining frequent backups and ensuring the ability to recover data from backups is crucial", and that entities should consider keeping backups offline. No backup guarantees recovery, and you should not assume a recovery time until you have tested one.

One thing to check: whether imaging files are actually included in the backup, and not only the schedule and charts. A restore test is how you find out.

Ask your provider: "Please restore one patient chart and one day of X-rays as a test. How long did it take, and what failed?"

What happens to patient care if systems go down?

Current requirement: the Security Rule calls for procedures for responding to emergencies and continuing critical business processes. Recommended practice: keep a recent printed or offline copy of the schedule and an emergency contact list, and decide in advance who calls patients and who calls your IT provider.

Who does what? Your practice and your IT provider

Many practices already have an IT company, so it is easy to assume everything is covered. Your provider may manage devices, updates and backups. Your practice still needs to know who is responsible for the risk analysis, written policies, staff training, incident response and fixing the problems the risk analysis finds. HHS's own overview of the rule lists these as administrative responsibilities of the regulated entity.

The questions at the end of this guide help you find out where the boundaries are today.

A realistic action plan

These are recommendations, not HIPAA deadlines. The right order and timing depend on your practice's risk and circumstances.

This week

• Name who is responsible for security in the practice.

• List everyone, including vendors, with remote access.

• Remove accounts for former staff and end shared logins where you can.

• Turn on MFA for email and remote access.

• Confirm a backup exists and find out when it was last restored.

• Write down your incident contacts: IT provider, attorney and any cyber insurer.

Within 30 days

• Begin or update your HIPAA security risk analysis.

• Inventory the systems and devices that store or touch ePHI, including imaging.

• Ask vendors about supported versions and update options.

• Run a test restore and record the results.

• Confirm business associate agreements are in place where needed.

Within 90 days

• Work through the highest-risk findings first.

• Limit what older devices can connect to, where feasible.

• Train staff and run a short incident drill.

• Document your decisions on addressable items such as encryption.

• Set triggers for revisiting the risk analysis, such as new software, new vendors or an incident.

What should we do if we suspect ransomware?

1. Isolate. Disconnect affected computers from the network, and get advice before powering them off.

2. Call your response contacts. That means your IT provider, your attorney and any cyber insurer.

3. Preserve evidence. Keep ransom notes and logs.

4. Report. HHS suggests considering the FBI or U.S. Secret Service. The ADA's risk management page links to the FBI's IC3 and CISA reporting tools.

5. Assess whether it is a breach. Document your analysis.

6. Restore from clean backups only after confirming the attacker is out.

7. Notify if required (see below).

Who must be notified after a breach, and when?

Breach notification is governed by the separate HIPAA Breach Notification Rule. Whether it applies depends on the facts, including whether unsecured PHI was affected. HHS says that when ePHI is encrypted by ransomware, a breach is presumed to have occurred unless you can demonstrate a low probability that the PHI was compromised, based on a risk assessment of at least four factors.

Encryption can change the answer, but only if it actually protected the data. PHI is "secured" only if it has been rendered unusable, unreadable or indecipherable to unauthorized people, for example by encryption consistent with HHS guidance. If the data was secured that way when the incident occurred, breach notification is not required. If the encryption did not protect the data at that moment, the data is treated as unsecured. Full-disk encryption, for example, may not protect files from a logged-in user. Not every security incident is a reportable breach, but you need a documented analysis.

Sixty days is the outer limit, not a target. State laws may add requirements, so involve your attorney early. Source: HHS Breach Notification Rule.

What should I ask my IT or security provider?

• Do you sign a business associate agreement?

• Who is responsible for patching, backups, monitoring and incident response? Is it in writing?

• Is MFA required on every administrator account and remote connection?

• When did you last restore from our backups, and how long did it take?

• Which of our devices can no longer be updated?

• Who has remote access, and how do we see when they connect?

• Can you support a documented risk analysis with the information we need?

• Who do we call after hours, and how quickly do you respond?

How can ClinicProof help?

A gap analysis compares what your practice does today with what the HIPAA Security Rule expects and lists where the two differ. ClinicProof, a tool within the SecureTrust Cyber cybersecurity platform, helps a practice:

• organize its HIPAA Security Rule gap analysis;

• document the gaps it identifies;

• track remediation activities and progress.

A gap analysis is useful for managing compliance work. It does not replace a comprehensive HIPAA security risk analysis, and no tool guarantees compliance. The two work best together: the risk analysis tells you what matters most, and a tracker helps you follow through.

Frequently asked questions

How often do we need a HIPAA risk analysis?

HIPAA requires an accurate and thorough analysis. HHS says the rule does not specify how often, the process should be ongoing, and it should be updated when circumstances change, such as a security incident or new technology. An annual compliance audit has been proposed, but it is not a current requirement.

Is ransomware a HIPAA breach?

It is a security incident. Whether it is a reportable breach depends on the facts, including whether unsecured PHI was involved and what your documented risk assessment shows. See the notification section above.

Are backups enough?

No. A backup helps only if you can restore from it. HHS stresses the ability to recover data from backups, so test restores and keep a copy offline.

What about older X-ray or imaging equipment that can't be updated?

Treat it as a documented risk. Ask the vendor about options, limit what the device connects to where feasible, and record your decision in your risk analysis.

Is our IT provider responsible for our HIPAA compliance?

Your dental practice remains responsible for meeting its HIPAA obligations, even when you hire an outside IT provider. A provider that is a business associate has its own applicable HIPAA responsibilities, which HHS says it is directly liable for under certain provisions. Your written agreements should make clear who handles tasks such as patching, backups, monitoring and incident response. Ask for evidence that those tasks are being performed rather than assuming they are covered.

Next step

Not sure whether your dental practice has a current HIPAA security risk analysis, or whether its findings have been addressed?

SecureTrust Cyber can help your practice assess risks to patient information, identify security gaps and develop a prioritized remediation plan. The SecureTrust platform includes ClinicProof, which helps organize HIPAA Security Rule gap analysis and track remediation progress.

Contact SecureTrust Cyber to schedule a consultation, and ask about a HIPAA security risk assessment for your dental practice.

Rick Selvidge, CISSP, is the founder and chief security engineer of SecureTrust Cyber. He has more than 25 years of experience in IT and cybersecurity and helps healthcare organizations identify and reduce security risks.

Sources: HHS Security Rule summary · 45 CFR 164.312 · HHS risk analysis guidance · HHS addressable vs. required FAQ · HHS business associates guidance · HHS Breach Notification Rule · HHS ransomware fact sheet · HHS proposed Security Rule fact sheet · ADA risk management resources · Becker's Dental Review