HIPAA compliance for dental offices: the security side

Who this page is for

• You’re the office manager of a dental practice with 1 to 6 dentists and no IT person on staff.
• Your practice management system runs on a server in a closet, or you recently moved to a cloud version.
• Your cyber insurance renewal is asking about MFA, EDR and backups, and you have about a month.
• An IT company set things up years ago, and you’re not sure what’s still current.

What this looks like in a dental office

A typical four-operatory office: the front desk shares one login to the practice management system so whoever is closest can check patients in. The intraoral sensor and panoramic X-ray run on a PC that can’t be upgraded because the imaging software “only works on that version.” Radiographs go to the oral surgeon as email attachments. Lab slips and referral letters go out on the fax machine.

Every one of those is a normal dental workflow. Each one maps to a specific Security Rule requirement, which is good news, because it means each has a specific fix.

What the Security Rule asks, applied to dental workflows

Shared front desk logins

Unique user identification is a required specification under 45 CFR 164.312(a)(2)(i). Open Dental’s own security documentation says “Every person who uses Open Dental should have a unique user name and password for logging on.” It also records logins and logoffs in an audit trail, which only means something if each person has their own account.

If you use Dentrix or Eaglesoft, ask the vendor or your IT company how to give each person their own login, set permissions by role, and pull an audit report [VERIFICAR].

Pair individual logins with automatic screen lock, an addressable specification under 164.312(a)(2)(iii), and a password manager so people don’t fall back to sharing.

Imaging and sensor PCs on old Windows

Microsoft ended support for Windows 10 on October 14, 2025, according to its lifecycle page. A computer with no security updates is a known vulnerability, and HICP’s small-office endpoint guidance, sub-practice 2.S.A in Technical Volume 1, lists removing end-of-life systems.

When the imaging software truly can’t move yet, document it. List the PC in your risk analysis, record why it stays, and limit its exposure: no email or web browsing on it, its own network segment if possible, EDR if the imaging vendor allows it, and a plan with a date. That is how an addressable decision gets documented under 164.306(d).

Ask your sensor or imaging vendor which Windows versions the current software supports before you buy a replacement PC [VERIFICAR].

The server in the closet

If your practice management data lives on a local server, three requirements meet in one place. Facility access controls under 164.310(a)(1) say lock it up. The data backup plan under 164.308(a)(7)(ii)(A) is required. And HHS’s ransomware fact sheet recommends offline backups and periodic test restores.

A USB drive that stays plugged into that server is not an offline backup.

X-rays and referrals to specialists and labs

HHS’s treatment FAQ says providers may share PHI for treatment by fax, email or phone with reasonable safeguards, such as confirming a fax number that isn’t used often and pre-programming frequent numbers.

HHS’s business associate guidance says a provider can share PHI with another provider for treatment without a BAA. Your email and fax vendors are a different matter. They store and transmit the X-rays, so they need BAAs. Whether a particular dental lab is a treating provider or a business associate is a question for your privacy official or attorney [VERIFICAR].

The email side is covered on the HIPAA compliant email page, and fax on the HIPAA online fax page.

Patient requests for records

This is a privacy issue, but it shows up in security conversations. In its Gums Dental Care determination, OCR looked at a solo practice in Silver Spring, Maryland, that didn’t send a parent and her children their records. The practice cited the lack of a secure website for email and a $25 certified mail fee.

OCR found neither was a valid reason, since the records could have been provided another way, and proposed a $70,000 civil money penalty. Lacking secure email is not a reason to delay access.

OCR enforcement involving dental practices

HHS’s resolution agreements list includes several dental actions:

Practice	Date	Issue	Result
Gums Dental Care (Maryland)	Published October 2024	Didn’t provide timely access to records	$70,000 civil money penalty
New Vision Dental (California)	December 14, 2022	PHI disclosed in responses to online reviews	$23,000 and a corrective action plan (HHS)
Three dental practices	September 2022	Patient right of access	Settlements announced together
A dental practice	October 2019	Social media disclosures of PHI	$10,000

None of these dental cases is a ransomware case. OCR’s security enforcement against small practices, like the neurology and surgical practice settlements, keeps finding the same gap: no accurate and thorough risk analysis.

ADA resources

The ADA’s HIPAA page lists member resources, including a sample Notice of Privacy Practices. Its ransomware article recommends training staff, backing up regularly with a copy off-site, being careful with links and attachments, and applying operating system and browser patches as soon as they’re released.

Options compared for a dental office

Need	Providers I work with	Options I don’t work with	Pricing info (as of October 2026)	What to check in a dental office
Endpoint protection on front desk, operatory and imaging PCs	Huntress (managed EDR); Coro (endpoint plus email)	Microsoft Defender for Business	Huntress Managed EDR MSRP $8.99 per endpoint per month, 50-seat minimum direct (Huntress); Defender for Business $3.00 per user per month, paid yearly (Microsoft); Coro by quote (Coro)	Whether your imaging vendor allows EDR on its PCs, and who watches alerts
Password manager for individual logins	Keeper	1Password	Keeper prices didn’t display when I checked [VERIFICAR] (Keeper)	Shared vault for insurance portals and lab portals
Staff training and phishing tests	Hook Security	KnowBe4	Hook prices per seat by quote (Hook)	Short lessons that hygienists and assistants can finish between patients
Fax for lab slips and referrals	Documo; Cloudli	SRFax, eFax Corporate	Documo Solo $25 per month billed annually (Documo)	BAA, and whether faxes go to a shared portal or to email
Risk analysis	CyberMaxx [VERIFICAR]	HHS SRA Tool (do it yourself)	Not published	Imaging PCs, server and cloud PM system in scope

The 50-seat Huntress minimum applies to direct and reseller purchases. A 10-person office would get Huntress through its IT company, which Huntress allows without a seat minimum.

What it costs

For a 10-computer office, using published list prices as of October 2026 and nothing else:

• Microsoft Defender for Business for 10 users: $30 per month, paid yearly.
• Huntress Managed EDR for 10 endpoints at MSRP: $89.90 per month, if bought through an IT provider that passes through list price.
• Documo Solo for fax: $25 per month billed annually.

What changes the price: number of computers including operatory and imaging PCs, whether a person monitors alerts after hours, whether your IT company already bundles a tool, and contract length. The HIPAA security checklist helps you see which of these you actually need.

My recommendation by office size

• If you have 1 dentist and 4 to 8 staff, start with individual logins, MFA on email and the PM system, EDR on every PC, and an offline backup. Do the risk analysis yourself with the HHS SRA Tool, using the risk assessment guide.
• If you have 2 to 4 dentists and an on-site server, add managed EDR so someone watches alerts, a tested restore of the PM database, and a separate network for imaging and guest Wi-Fi.
• If you have several locations, consider an outside risk assessment and MDR. Written security expectations for your IT company become important, because one compromise can reach every office.

How implementation works

1. Week 1: list every computer, including imaging and sensor PCs, and every vendor that touches PHI. Confirm BAAs with your PM software, email, fax, IT company and backup vendor.
2. Weeks 2 to 3: individual logins in the PM system, MFA on email, a password manager, and automatic screen locks.
3. Weeks 3 to 5: EDR on every PC the imaging vendor allows, encrypted laptops, and a backup copy that isn’t reachable from the office network.
4. Weeks 5 to 8: finish the risk analysis and a one-page incident response plan, run a phishing test, and test a restore.

Questions to ask your dental IT company

1. Which of our computers can’t get security updates, and what is the plan for each?
2. Is there an offline or immutable copy of our practice management and imaging data, and when was it last restored?
3. Who sees an EDR alert at 9 pm on a Friday, and what do they do?
4. Does your remote access tool use MFA, and will you sign a BAA?
5. Can each staff member have their own login in our practice management system, with the right permissions?

Common mistakes in dental offices

1. One login for the whole front desk. It breaks the unique user requirement and makes the audit trail useless.
2. “The imaging PC can’t be touched.” It can be documented, isolated and kept off email. Leaving it alone with no record is the mistake.
3. Responding to online reviews with patient details. New Vision Dental paid $23,000 over this.
4. Backups on the server’s own USB drive. Ransomware that reaches the server can reach that drive.
5. The IT company’s remote tool without MFA. It’s a direct path to every computer in the office.
6. Faxes landing in a tray at the check-in window. Move the machine or move to a portal.

For the cyber insurance side of your renewal, see cyber insurance requirements, and for the full picture, the healthcare cybersecurity guide. If you’d like me to compare security options for your dental office before your renewal, send me your office details.