HIPAA Cybersecurity for Dental Practices: What the Security Rule Actually Requires

Obsidian Ridge is a Huntress partner and earns money from the managed service described here.

Many dental practice owners have a HIPAA binder. Some have refreshed it. Far fewer have a current, written risk analysis that an Office for Civil Rights (OCR) investigator would accept as evidence that the Security Rule is being followed.

That is not a moral failure on the part of dentists. It is a structural one. The HIPAA Security Rule was written in 2003, amended through the HITECH Act and the 2013 Omnibus Rule, and is now proposed for substantial modernization through the 2025 Notice of Proposed Rulemaking.

Almost none of that conversation reaches a four-chair practice through normal channels.

This guide walks through what the Security Rule actually requires, what the 2025 NPRM proposes to add, where dental practices most commonly fall short, and what a defensible 90-day path looks like for a small office.

A note up front: we operate the technical safeguards side of this work. We are not your HIPAA Privacy Officer, and we are not lawyers. The dentist or practice owner remains the Privacy Officer, and substantive legal questions should go to qualified HIPAA counsel.

The direct answer

The HIPAA Security Rule requires every dental practice to conduct and maintain a current, written risk analysis, then implement administrative, physical, and technical safeguards proportionate to the risks that analysis identifies.

It is not a fixed checklist — the standard is risk-based — but Office for Civil Rights enforcement against small providers points to the same repeat gaps:

• No current risk analysis
• No written risk management plan
• Missing Business Associate Agreements
• Shared logins
• No audit controls or encryption

Addressable specifications like encryption are not optional; the practice must either implement them, or document a reasonable equivalent that meets the same risk objective.

If the risk analysis is the gap, the free HHS Security Risk Assessment tool is the usual starting point, and how to use it and when to get help walks through what it does and does not produce.

Obsidian Ridge operates the technical-safeguards side of that list for dental practices through Ridge Core at $25 per person per month, month to month with no minimum: managed endpoint detection and response plus Microsoft 365 or Google Workspace identity monitoring, with the access, audit and incident-response evidence an OCR investigator or a carrier asks to see. For HIPAA-covered entities, we also sign a Business Associate Agreement before the engagement begins. The risk analysis, the Privacy Officer role and legal decisions stay with the practice.

What does the HIPAA Security Rule actually say?

The Security Rule lives at 45 CFR Part 164, Subpart C. It is short by federal standards and surprisingly readable. There are three groups of standards, and every covered dental practice has to address all three.

Administrative safeguards sit at 45 CFR § 164.308. These are the people-and-process controls:

• A designated Security Official
• A documented risk analysis and risk management process
• Sanction policy
• Workforce training
• Access management
• Incident response procedures
• Contingency planning

Physical safeguards sit at 45 CFR § 164.310. These cover facility access, workstation use and location, and device and media controls.

In a dental office this translates to:

• Who can walk behind the front desk
• Whether operatory computers face the hallway
• How old hard drives are destroyed
• How the server (if there is one) is physically secured

Technical safeguards sit at 45 CFR § 164.312. These are the controls that touch the systems directly:

• Access control
• Audit controls
• Integrity controls
• Person or entity authentication
• Transmission security

Two more sections matter and are often forgotten. 45 CFR § 164.314 covers the organizational requirements — primarily Business Associate Agreements.

45 CFR § 164.316 covers documentation requirements, including the six-year retention rule for policies, procedures, and Security Rule records.

Required versus Addressable — the misunderstanding that costs practices money

Inside those standards, individual implementation specifications are labeled either Required or Addressable. The second category is the one that gets misread.

"Addressable" does not mean optional. It means the practice must do one of three things, and document the choice:

• Implement the specification as written
• Implement a reasonable and appropriate alternative that achieves the same objective
• Document why the specification is not reasonable and appropriate for the practice and what equivalent measure is in place

OCR has been very clear in guidance and in enforcement that "we read it, we passed" is not a valid third option.

Encryption of ePHI at rest and in transit is Addressable. In 2026, with the threat environment as it is, there is essentially no defensible "not reasonable" argument for skipping disk encryption on laptops or TLS on email carrying claim attachments.

The Addressable label is not a loophole; it is a documentation obligation.

Where does ePHI actually live in a dental practice?

Before any of the safeguards make sense, the practice has to know where its electronic Protected Health Information is. That map is usually wider than the owner expects.

The practice management system is the obvious one — Dentrix, Eaglesoft, Open Dental, Curve Dental, Carestream, Dentrix Ascend, Denticon, and newer cloud entrants all qualify. But ePHI also flows through, and rests in:

• Digital intra-oral imaging and panoramic systems
• CBCT (cone beam) systems, which often store DICOM data on a separate workstation
• The Outlook or Google Workspace mailbox the front desk uses for pre-authorizations and referrals
• The fax-to-email service that drops insurance correspondence into that mailbox
• The website contact form, if it accepts symptom or insurance information
• The SMS appointment reminder system, if it contains identifiers
• The local file server or NAS where scanned forms and treatment plans get saved
• The backup target — local NAS, USB rotation, or cloud
• The doctor's personal laptop, used to review cases from home

Each system has to appear in your risk analysis. The doctor's home laptop with ePHI and no full-disk encryption is a common gap, and one of the easiest for OCR or a plaintiff's attorney to identify after the fact.

The risk analysis — the single most important control

45 CFR § 164.308(a)(1)(ii)(A) requires a covered entity to "conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity."

That sentence has done more enforcement damage than any other in the Security Rule.

OCR publishes its resolution agreements and corrective action plans, and the single most consistent finding across small healthcare providers — dental included — is the absence of a current, accurate, and thorough risk analysis.

The next most consistent is the absence of a written risk management plan addressing the gaps the analysis identified.

A real risk analysis is not a checklist a vendor sells for $399. It:

• Identifies every system that creates, receives, maintains, or transmits ePHI
• Documents the applicable threats and vulnerabilities
• Assesses likelihood and impact
• Produces a remediation roadmap with owners and dates

NIST SP 800-66 Rev. 2 is the closest thing to an official methodology walkthrough.

Cadence matters too. Re-perform the analysis at least annually and after any material change — new PMS, new imaging system, an office move, a new IT vendor, an acquisition, an incident, or a significant staffing change.

The 2025 HIPAA Security Rule NPRM — where this is heading

OCR issued the Notice of Proposed Rulemaking on December 27, 2024 and it was published in the Federal Register on January 6, 2025 (90 FR 898). Comments closed on March 7, 2025. It is still a proposal — as of November 2026 no final rule has been published under RIN 0945-AA22 — but it is the clearest signal HHS has given in two decades about the direction of enforcement.

We recommend most practices align with it now rather than wait.

Proposed changes that matter most for a dental practice:

• Mandatory MFA on systems that access ePHI, removing the Addressable label
• Mandatory encryption of ePHI at rest and in transit, again removing the Addressable label
• A written incident response plan that is tested, not just documented
• Network segmentation so that imaging, PMS, guest Wi-Fi, and general business systems are not all on the same flat network
• Vulnerability scanning at least every six months
• Annual penetration testing
• Asset inventory that is maintained, not point-in-time
• A compliance audit at least annually

Some of those will be operationally heavy for a single-location practice, and the final rule may soften specific timelines. But the underlying message — that Addressable is being narrowed, and that documented technical control is now the floor — is not going to reverse.

Treat the NPRM as the planning baseline.

Business Associate Agreements — the dental-specific landmines

45 CFR § 164.502(e) requires the practice to obtain satisfactory assurances, through a written contract, that a business associate will safeguard the information; § 164.504(e) and § 164.314(a) set out what that contract has to say, and § 160.103 defines who counts as a business associate — any vendor that creates, receives, maintains, or transmits ePHI on the practice's behalf. In dental, this gets more complicated than most owners expect.

Where to look for missing or stale BAAs:

• Cloud PMS vendors — these almost always have a BAA available, but the practice has to actually request and sign it. We have walked into offices on cloud PMS for three years where the BAA was never executed.
• Imaging cloud vendors — DICOM-in-the-cloud, second-opinion platforms, CBCT analysis services.
• The local "IT guy" — if your IT support has remote access to operatory or front-desk computers, they touch ePHI. They need a BAA. "We trust him, he's been with us 12 years" is not a defense.
• Cloud backup vendors — yes, even if the data is encrypted.
• Email providers — Microsoft 365 and Google Workspace offer BAAs for the right license tiers. Default sign-up does not include one.
• Practice marketing vendors — reactivation lists, recall communications, anything with patient identifiers.

Vendors that typically refuse to sign BAAs — and therefore should not be receiving ePHI — include most consumer-grade SMS tools, free email marketing platforms, and general-purpose cloud storage on default plans.

An AI scribe or notetaker that hears the appointment belongs on the same list of Business Associates, and the agreement question comes before the first recording. See AI scribes and patient audio: ask the BAA question first.

The Breach Notification Rule

45 CFR §§ 164.400-414 define what counts as a breach and how a practice has to respond. A breach is, broadly, the acquisition, access, use, or disclosure of PHI in a manner not permitted by the Privacy Rule that compromises the security or privacy of the information.

The 2013 Omnibus Rule shifted the standard so that an impermissible use or disclosure is presumed to be a breach unless the covered entity can demonstrate, through a documented four-factor risk assessment, that there is a low probability the PHI was compromised.

Timelines:

• Fewer than 500 individuals affected: notify each affected patient without unreasonable delay and no later than 60 days from discovery, and submit an annual log of these breaches to HHS within 60 days after the end of the calendar year.
• 500 or more individuals affected: notify patients, HHS, and prominent media outlets in the affected state, all without unreasonable delay and no later than 60 days from discovery.

A practical note: the 60-day clock starts at discovery, not at the date of the underlying incident. Once a staff member becomes aware that ePHI may have been improperly accessed, the clock runs.

This is one reason a written incident response procedure matters — without it, the discovery date becomes ambiguous and arguments about timeliness get harder to defend.

Where does OCR enforcement actually focus for small dental practices?

We are deliberately cautious about citing specific dental enforcement actions, because we would rather be conservative than wrong. What we can say is what OCR's published settlements consistently reveal across small healthcare providers, dental included:

• Most cited deficiency: absence of an accurate, thorough, current risk analysis.
• Second most cited: absence of a documented risk management plan tied to that analysis.
• Missing BAAs are routinely flagged, particularly with IT vendors and cloud services.
• Shared accounts and weak access controls show up repeatedly at the front desk.
• Failure to implement audit controls — no record of who accessed what ePHI when — is common once OCR begins to look.
• "We followed our policies" fails when the policies cannot be produced in writing.

OCR does not require perfection. It requires reasonable, documented, consistent application of the Security Rule, with the risk analysis as the central artifact.

Practices that can produce a current risk analysis, a remediation plan, training records, BAAs, and a documented incident history almost always come out of investigations far better than those that cannot.

What are the common HIPAA gaps in small dental offices?

Almost every initial assessment surfaces some combination of the following:

• A shared "frontdesk" login on the PMS or Windows itself, used by three or four people. This violates 45 CFR § 164.312(a)(2)(i) (Unique User Identification — a Required specification).
• No MFA on Microsoft 365 or Google Workspace, despite the mailbox carrying insurance correspondence with patient identifiers.
• A backup that has been "running" for years but has never been tested by restoring data.
• The PMS vendor has a BAA. The imaging cloud does not.
• The IT contractor has full remote access and has never signed a BAA.
• The doctor's home laptop has the PMS client installed and is not encrypted.
• Guest Wi-Fi sits on the same network as the operatory computers.
• No written incident response procedure.
• The risk analysis is missing entirely or is a five-year-old PDF.

None of these are exotic. All are fixable. Most are exactly what OCR, an insurance underwriter, or an attorney's expert witness will look for first.

A practical 90-day path for a small practice

For a one-doctor or small-group practice, defensible HIPAA remediation usually fits inside a quarter if there is real ownership. Order matters.

Weeks 1–2: scope and inventory. Build the ePHI map. Every system, every vendor, every device. List the Business Associates and check which BAAs are actually executed.

Weeks 3–4: risk analysis. Conduct a real risk analysis against the inventory. Output: a written document with identified risks, likelihood and impact, and a remediation plan with owners and target dates.

Weeks 5–8: technical remediation. Enforce MFA on Microsoft 365 or Google Workspace and on any remote access.

Enforce unique user accounts on the PMS and Windows — eliminate shared logins. Encrypt every laptop. Confirm the backup actually restores.

Segment guest Wi-Fi off the operatory network. Deploy managed endpoint detection on every workstation and server with ePHI.

We offer Huntress MDR and Managed ITDR to help record detection and response activity. These products are not proof that a practice meets the technical safeguards at § 164.312; the practice must assess its full program and evidence.

Weeks 9–10: administrative remediation. Update policies to match what is now actually happening — sanction policy, access management, contingency plan, incident response. Train staff and document the training.

Annual security awareness with phishing simulation is now baseline; managed security awareness training is the operational path for practices that prefer not to run the cadence themselves.

Weeks 11–12: documentation and ongoing operation. Execute missing BAAs. Build a single folder containing the risk analysis, risk management plan, policies, training records, BAAs, and incident log.

Set cadence: quarterly access review, annual risk analysis refresh, annual training, monthly backup restore tests.

This sequence is also what most cyber insurance underwriters now expect at renewal. If you are heading into renewal, our cyber insurance readiness walkthrough covers the underwriter questions in detail.

Where Obsidian Ridge fits — and where we do not

We want to be precise about our role, because dental owners are often sold "HIPAA compliance" as a single product, and it is not.

We operate the technical safeguards:

• 24/7 managed detection and response across every device that touches ePHI
• Identity threat detection on Microsoft 365 — the front line where dental email account takeover begins
• Managed security awareness training and phishing simulation
• Vulnerability scanning, log review, and the technical evidence package supporting your audit controls obligation under § 164.312(b)

We can also help build the ePHI inventory, structure the risk analysis, and pressure-test your incident response procedure.

What we are not:

• We are not your HIPAA Privacy Officer
• We are not your attorney
• We do not file your breach notifications

The practice owner remains the Privacy Officer, and substantive legal questions go to qualified counsel. A "HIPAA program" bought from a single vendor that promises to handle everything can leave a practice with neither a Privacy Officer nor a defensible technical environment.

Where to go from here

If you are reading this and realizing your practice does not have a current risk analysis, your BAAs are incomplete, or your front desk is sharing a login — you are not unusual. You are also exactly where OCR's enforcement pattern says the risk lives.

The right next step is not panic. It is an honest 60-minute assessment of where you actually stand against the Security Rule, followed by a written plan with owners and dates.

We offer that as part of our dental cybersecurity program, and we are happy to walk through your environment with no expectation that you sign anything afterward.

Talk with us, or send us your most recent risk analysis and we will tell you honestly whether it would hold up. The worst time to find out is during an OCR letter or an underwriter's renewal question. The best time is now, on your own schedule, before either happens.