Choosing dental security before cyber-insurance renewal

Choose a dental security provider by asking it to prove the scope behind your insurance answers. A renewal is a useful deadline for checking what is deployed, who acts and which records the practice can produce. It is not a reason to buy an undefined bundle.

Obsidian Ridge's Ridge Core includes endpoint MDR and Microsoft 365 or Google Workspace ITDR at $25 per person per month, month-to-month with no minimum and business onboarding separate. Huntress's SOC monitors and acts 24/7; Obsidian Ridge provides CISSP-led follow-through within one business day, serving the Research Triangle and businesses across the United States. Ridge Plus costs $50 per person per month on an annual term, billed monthly, with no minimum. It adds staff training, email-security configuration and a secure browser to Ridge Core; business onboarding is separate. The checks below apply to our proposal too. Compare the dental programme, MDR provider comparison and practice cost guide against the same inventory.

Which nine checks belong in the buying conversation?

1. Start with the carrier's actual form

Ask which control each question refers to and what evidence supports the answer. Keep a dated copy. Record exceptions and partial coverage. A future deployment date is different from a control already operating. Use free application help when the wording is unclear.

2. Count every supported device

Include front-desk computers, clinical workstations, laptops and servers. Identify devices the provider cannot support and the person responsible for them. A staff-based rate does not replace a machine inventory. Ask how changes to the inventory will be recorded during the policy period.

3. Check the account layer separately

Identify the Microsoft 365 or Google Workspace tenant, administrator accounts and MFA coverage. Managed ITDR and endpoint MDR cover different activity. Require the provider to state supported Google or Microsoft actions rather than relying on a generic identity-security label.

4. Put response responsibilities in writing

Who watches at night? Who may isolate a workstation? Who contacts the practice and who restores its applications? Our SOC and follow-through responsibilities are stated above. Your IT provider and clinical software vendor still need named roles for their systems.

5. Check the HIPAA responsibilities and agreements

The ADA's HIPAA resources help dental practices navigate their obligations; they do not certify a security vendor. Determine whether a provider is a business associate for the engagement and address the required agreement. Ask which safeguards it operates and which remain with the practice. ADA HIPAA resources; HHS business-associate guidance.

6. Request a sample of the evidence

Ask for a redacted device-coverage record, incident report and training-completion export. Check whether each identifies the relevant period and systems. Do not treat a purchased licence as proof of completed training or uninterrupted monitoring. The training comparison separates delivery from reporting.

7. Identify who runs and tests backups

Get the backup scope and a dated restore-test result from the responsible provider. Ask how restoration of the practice-management system is coordinated. Obsidian Ridge does not include managed backup in the monthly tiers; the Sprint can check the evidence without becoming the backup operator.

8. Compare the whole commercial scope

Identify the billed unit, contract, onboarding, log add-ons and separately billed response work. Business setup here is $500 for up to 25 machines, or $1,000 for 26 to 100. Core is month-to-month; Plus is annual, billed monthly. The pricing page and cost guide identify those boundaries. Do not compare a device rate with a person bundle as though they include the same services.

9. Keep ownership of the answers and the gaps

The practice must approve truthful answers and understand the exceptions. The security provider explains its controls; the broker and carrier handle the insurance decision. Assign each remaining gap to a person and a date instead of letting it disappear into a proposal.

How does the HIPAA programme fit around renewal?

HHS describes risk analysis, access safeguards, training, activity review and contingency planning as parts of the Security Rule programme. Insurance evidence can overlap with that work, but the application does not replace the practice's full programme. HHS Security Rule summary.

Keep the responsibilities with the people who can perform them. A monitoring provider, IT firm, practice manager and adviser may each hold different records. The useful outcome is an answer the practice understands and can support.

How can the practice get help?

Obsidian Ridge offers a free, one-off cyber-insurance questionnaire review for small businesses. Email your carrier's questionnaire to security@obsidianridge.io; our CISSP-led practice replies within one business day, serving the Research Triangle and businesses across the United States. We are not an insurance agent or broker. Use the application-help page and questionnaire worksheet. The Readiness Sprint costs $1,500 to $3,500 once for a 7-business-day engagement. The deliverable is the same at each scope: a signed evidence pack and a record of controls and gaps. The Sprint is the paid evidence engagement if that additional work is needed. It does not guarantee insurance approval or a particular premium.

Sources

Fetched October 2, 2026.

• ADA HIPAA resources: dental-practice compliance resources.
• HHS business associates: when business-associate arrangements apply.
• HHS Security Rule summary: security programme requirements.
• Obsidian Ridge pricing and dental scope: service rates and responsibilities.