Book a call

HIPAA-aware IT for a dental practice: a plain-language checklist

What the HIPAA Security Rule expects from a small dental or medical office's computers, network and vendors, translated into the eighteen things to check this month, with the two that practices in Tracy most often miss.

IT & Cybersecurity · Next Plus team, Mountain House, CA · · 4-minute read

Who this is for

The dentist, practice manager or office lead in Tracy, Mountain House or Manteca who signs the compliance attestation each year and would like to know what it actually covers.

What you will have by the end
  • What counts as protected health information in a dental office, including the places people forget
  • The eighteen technical and vendor controls the Security Rule expects, in checklist form
  • Why imaging backups and old workstations are the two most common gaps locally
  • What a business associate agreement is and who needs to sign one with you

Most dental practices we visit in Tracy and Mountain House have the same compliance folder: a risk assessment from the year the practice opened, a binder of policies, and an annual attestation signed in good faith. The computers have moved on since then. This guide translates what the HIPAA Security Rule expects from the technical side into a list you can check in a month.

What protected health information looks like in a dental office

It is not only the chart. Electronic protected health information in a practice includes the practice-management database, the imaging system and every x-ray on it, the appointment book, insurance claims and remittances, the voicemail system if it records messages, the email account that patients write to, the scanned driver’s licenses on the front-desk PC, and the text-message reminders. If it identifies a patient and relates to their care or their bill, it is in scope, wherever it sits.

What the Security Rule actually expects

The rule does not name products. It expects a documented risk analysis, reasonable technical safeguards, policies and training, agreements with the vendors who touch patient data, and a plan for when something goes wrong. The technical safeguards translate into the list below.

People and access

Unique logins for every person. No shared front-desk account. Every action in the practice software should be traceable to one named person. Multi-factor authentication on email, remote access and the practice-management system wherever it is supported. Automatic screen lock after a few minutes on every workstation, including the operatories. Access removed the same day someone leaves, with a short checklist so it actually happens.

Devices and data

Encryption on every laptop and on any backup drive that leaves the building. A stolen encrypted laptop is a lost laptop; an unencrypted one is a reportable breach. Supported operating systems. Windows 10 reached the end of support in October 2025; a workstation still running it, often the one attached to the imaging sensor, receives no security patches. Patching on a schedule for the rest. Managed endpoint protection on every device, reporting to a console someone watches.

Backups

Backups of the practice database and the imaging store, with a copy that ransomware cannot reach. Imaging is the one practices forget: it is large, it lives on one PC, and losing it means re-taking x-rays. A restore test, written down, at least quarterly. A backup that has never been restored is a hope.

Network and email

A business-class firewall with remote management turned off on the internet side. Patient Wi-Fi on a separate network from the practice systems. No remote desktop open to the internet; remote access through a VPN or a managed tool with MFA. Email encryption when patient information has to be sent, and a rule for staff on what never goes in a plain email. Audit logging on in the practice software and in Microsoft 365 or Google Workspace, with retention long enough to investigate.

Vendors

A business associate agreement with every vendor that creates, receives or stores patient data on your behalf: the cloud practice-management company, the imaging vendor if it hosts anything, the backup service, the IT provider, the answering service, the e-claims clearinghouse. Keep the signed copies with the risk analysis. Vendor accounts reviewed yearly and removed when the relationship ends.

When something goes wrong

A one-page incident plan: who isolates the device, who calls the IT provider, who notifies the practice owner, where the backups are, and when the breach-notification clock starts. Cyber insurance that knows you are a healthcare practice, with the questionnaire answered from the controls above rather than from memory.

The eighteen-point practice checklist

  • Unique login for every person, no shared accounts
  • Multi-factor authentication on email, remote access and practice software
  • Automatic screen lock on every workstation
  • Same-day access removal when staff leave
  • Encryption on every laptop and portable drive
  • No unsupported operating systems, including the imaging workstation
  • Patching on a written schedule
  • Managed endpoint protection on every device
  • Backups of the practice database and imaging with an unreachable copy
  • Restore test performed and dated each quarter
  • Business-class firewall, remote management off
  • Patient Wi-Fi separated from practice systems
  • No remote desktop exposed to the internet
  • Email encryption available and staff know when to use it
  • Audit logging on with adequate retention
  • Business associate agreements signed with every data vendor
  • Vendor accounts reviewed yearly
  • One-page incident plan and a current cyber-insurance policy

A note on the risk analysis

The Security Rule’s first requirement is a risk analysis, and investigators ask for it first. If yours is older than the computers it describes, update it. A current list of systems, where patient data lives, and the controls above with dates is most of the work, and it turns the annual attestation from a signature into a statement you can stand behind.

Questions people ask about this

Does HIPAA actually apply to a small dental practice?

Yes. Any practice that bills insurance electronically is a covered entity, and the Security Rule applies regardless of size. Enforcement for small practices has typically followed a breach or a complaint, which is exactly when the gaps become expensive.

Is a cloud practice-management system HIPAA compliant by itself?

The vendor can be, under a business associate agreement, for the part they run. Your workstations, your Wi-Fi, your email and your staff accounts are still yours to secure. Compliance is the combination, not the vendor's badge.

What is the single most important fix?

Unique logins with multi-factor authentication for every person, and automatic screen lock. Shared front-desk logins mean no audit trail, and no audit trail means every incident becomes a breach of unknown size.

Is this legal advice?

No. HIPAA includes administrative and physical safeguards, policies and training that go beyond IT. This guide covers the technical side an IT provider is responsible for. Your compliance officer or counsel covers the rest.

Have this handled

The free IT check-up for a practice goes through this list against your own systems and leaves you with a one-page summary and the gaps in order. Thirty minutes, mostly remote, no obligation.

We reply within one business day.