Dental and oral surgery practices hold exactly what attackers want: names, birth dates, insurance details and years of patient records, usually protected by a small team with no full-time IT staff. Ransomware groups know a practice that cannot see its schedule or open its imaging will feel pressure to pay fast. HHS publishes every healthcare breach that affects 500 or more patients, and dental and oral surgery practices appear on it regularly.
The good news is that most breaches come through the same handful of gaps. Close them and you are ahead of most practices. This guide walks through what actually matters, in plain language, whether you run one office or twenty.
1. Know where your patient data lives
You cannot protect what you have not mapped. In a typical practice, patient data sits in more places than people expect:
- The practice management server or cloud system (Dentrix, Eaglesoft, Open Dental and others)
- Imaging storage for CBCT, pano and intraoral images, which grows fast
- Front desk and operatory workstations, including downloads folders and scanned documents
- Email, especially attachments sent to labs, specialists and insurance companies
- Phones, tablets and laptops that leave the building
- Backups, both on-site and in the cloud
Write this list down. It is the starting point for everything else, and your yearly risk assessment will ask for it anyway.
2. Lock down who can get in
Stolen passwords are still the easiest way into a practice. The fixes are simple:
- Multi-factor authentication on email, remote access and any cloud system that holds patient data.
- A unique login for every person. Shared front desk logins make it impossible to know who did what.
- Same-day offboarding. When someone leaves, their access ends that day, including email, remote tools and the practice software.
- Only the access each role needs. A hygienist does not need admin rights on the server.
3. Stop ransomware before it starts
Ransomware usually arrives through a phishing email, an unpatched system or remote access left open to the internet. The defenses:
- Endpoint protection on every computer and server, watched 24/7, so an attack is caught and isolated in minutes instead of discovered on Monday morning.
- Patching on a schedule for Windows, browsers, firewalls and practice software.
- Email filtering that blocks malicious links and attachments before they reach the inbox.
- No remote desktop open to the internet. Remote access goes through a secure, MFA-protected tool.
4. Make sure your backups actually restore
A backup that has never been tested is a hope, not a plan. Ransomware also targets backups that sit on the same network as the server. A solid setup looks like this:
- At least three copies of your data, on two kinds of storage, with one copy off-site.
- One copy that ransomware cannot reach or change, either offline or immutable.
- Encrypted backups, so a lost drive is not a breach.
- Regular restore tests, including your imaging, with a known answer to “how long until we are seeing patients again?”
5. Encrypt what leaves the building
Lost and stolen laptops are one of the most common breach causes. Full-disk encryption on every laptop and workstation turns a stolen device into a hardware problem instead of a reportable breach. Patient information sent by email should go through an encrypted email option, not a regular message.
6. Secure the network
- A business-grade firewall that is updated and monitored, not the box the internet provider left behind.
- Guest and patient Wi-Fi kept completely separate from the clinical network.
- Imaging devices, phones and printers on the network inventory, with default passwords changed.
7. Train your team to spot phishing
Most attacks still start with someone clicking a link. Short, regular phishing awareness training makes a real difference, especially for front desk staff who open emails from patients, insurers and vendors all day. Your compliance firm can usually provide it alongside your risk assessment.
8. Get a BAA from every vendor that touches patient data
Your IT company, cloud backup provider, phone system, imaging vendor and any software company that can see patient data are business associates under HIPAA. Each one should sign a Business Associate Agreement before they get access. If a vendor will not sign one, that tells you something.
9. Plan for a bad day before it happens
Write down, on paper, who you call if something goes wrong: your IT provider, your cyber insurance carrier and the incident response firm your policy uses, and your attorney. Know how to take an infected computer off the network. A one-page plan saves hours when every minute counts.
10. Do a yearly risk assessment, then fix what it finds
HIPAA requires a security risk analysis. It should come from a cybersecurity and compliance firm, not from the same company that runs your IT, so nobody is grading their own work. The value is in the follow-through: every finding gets fixed, documented and checked the next year.
A quick data security checklist
- Patient data locations mapped and written down
- MFA on email, remote access and cloud systems
- Unique logins and same-day offboarding
- 24/7 monitored endpoint protection on every device
- Scheduled patching and email filtering
- Encrypted, off-site, ransomware-proof backups with tested restores
- Full-disk encryption on laptops and encrypted email for patient information
- Business-grade firewall and separate guest Wi-Fi
- Phishing awareness training for staff
- Signed BAAs from every vendor that touches patient data
- A written plan for a security incident
- A yearly risk assessment from a compliance firm, with every finding fixed
Where Xceltek fits
Xceltek handles the IT side of this list for dental, oral surgery and medical practices. We sign a BAA before we touch patient data, run 24/7 monitored endpoint protection, MFA, patching, encryption and tested backups, manage your firewall and network, and fix the findings from your yearly risk assessment, which comes from a compliance firm such as our sister company Cytek or the firm you already use. Most problems are fixed remotely in minutes, and we put a technician on-site wherever your offices are when hardware needs hands.
Want to know where your practice stands? Book a free 30-minute IT and security review. You will come away knowing what is fine, what needs attention and what it would take to fix, whether or not you work with us.
Related: HIPAA compliant IT services · How to choose a healthcare IT company · Dental IT · Data protection and backups
