HIPAA-aligned cybersecurity for the practice, not the brochure.

TL;DR

What dental practices get, and what it costs

We operate managed detection and response, identity threat detection, and security awareness training for your practice end-to-end. The 24/7 SOC watches every endpoint and your Microsoft 365 or Google Workspace tenant for the attack patterns documented across the dental vertical:

• PMS ransomware
• Business-email compromise targeting the office manager
• Identity-layer attacks that bypass MFA

Obsidian Ridge adds the security-operations side: HIPAA-aligned configuration, audit-control evidence, cyber-insurance readiness, incident-response coordination, and the quarterly executive briefing for the doctor and the practice manager.

Pricing, per month:

• Foundation, $15 per device: endpoint only.
• Protected, $32 per user: adds identity threat detection and the awareness program. This is the tier to look at: it covers the controls cyber insurance applications ask about, including business email compromise.
• Complete, from $55 per user: adds Managed SIEM and the full compliance evidence program.

Not ready for the full program yet? Ridge Watch ($15 per device per month, monitoring only) is an honest first step — real protection now, though a practice handling ePHI will want the controls above before an audit or an insurance renewal.

See full pricing and what each tier includes

How we work

Alongside your current IT company

Keep your IT company. They handle the help desk, the hardware and the everyday fixes. We run the security layer beside them: threat detection and response, and the evidence insurers and auditors ask for.

What we don't do

• Help desk and everyday IT support
• Printers and office hardware
• Practice-management software support: installs, upgrades, troubleshooting

For a dental practice, that means your IT vendor and the software vendor keep Dentrix, Eaglesoft and Open Dental. We watch the computers and the server they run on.

The threat model

What actually goes wrong in dental practices in 2026

Three attack patterns matter most.

1. Practice management system ransomware

The attacker phishes the office manager and lands a loader. Then:

• Moves laterally to the PMS server
• Exfiltrates the patient database
• Encrypts everything on a Friday evening

Monday morning the practice cannot bill, treat, or look up a patient.

Full walkthrough of the attack chain. What would the downtime cost your practice? Run the 2-minute calculator.

2. Business email compromise + wire fraud

The attacker phishes the office manager's Microsoft 365 credentials through an adversary-in-the-middle kit. Then:

• Captures the session token, so MFA is already satisfied
• Sets an inbox rule that hides invoice and wire emails
• Reroutes a lab payment to a foreign bank account

The pattern in detail.

3. HIPAA breach via unhardened defaults

• Shared front-desk accounts
• No audit-log review
• An open SQL Server sa password from a 2018 install
• A USB backup drive that ransomware encrypted along with everything else

OCR enforcement keeps finding the same gaps:

• No current risk analysis
• No workforce training records
• BAAs missing for cloud vendors

What the Security Rule actually requires.

For the wider set of regulated-industry writeups — HIPAA, IRS Publication 5708, ABA model rules, cyber-insurance controls — browse the compliance blog.

The HIPAA Security Rule lists a risk analysis as Required: “an accurate and thorough assessment of the potential risks and vulnerabilities” to the electronic protected health information the practice holds.

The same section requires:

• Security measures that bring those risks down to a reasonable and appropriate level
• Procedures to regularly review system activity records such as audit logs and access reports

A cyber insurance application asks about many of the same controls: endpoint detection, multi-factor authentication, staff training and backups. Evidence built for one answers much of the other, so we build it once.

What we bring to both

• Managed detection and response on every workstation and the practice-management server, watched by Huntress's 24/7 SOC.
• On Protected and Complete, identity threat detection on Microsoft 365 or Google Workspace, and security awareness training with completion records.
• The evidence: the Readiness Sprint maps your carrier's questionnaire to the control that answers each question and hands you a signed evidence pack.

Where our work stops

We work alongside the practice's existing IT vendor. We do not support Dentrix, Eaglesoft or Open Dental: installing, upgrading, configuring and troubleshooting them stays with your IT vendor and the software vendor. Backups are not part of any tier; the Readiness Sprint checks yours.

Obsidian Ridge is not an insurance producer, broker, or agent. We do not sell, place, or advise on insurance products.

Source: 45 CFR 164.308(a)(1)(ii), eCFR, current text, fetched September 25, 2026. A general summary, not legal advice.

Under the HIPAA Breach Notification Rule, a HIPAA-covered entity that experiences a breach of unsecured protected health information generally must:

• Notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of the breach. This deadline is the same whether the breach affects one person or many.
• Notify the U.S. Department of Health and Human Services (HHS): For breaches affecting 500 or more individuals, notify HHS without unreasonable delay and no later than 60 calendar days after discovery. For breaches affecting fewer than 500 individuals, the covered entity may log the breach and notify HHS annually, no later than 60 days after the end of the calendar year in which the breach was discovered.
• Notify prominent media serving the affected state or jurisdiction for breaches affecting more than 500 residents of that state or jurisdiction, without unreasonable delay and no later than 60 calendar days after discovery.

A business associate that experiences a breach must notify the covered entity, generally without unreasonable delay and no later than 60 calendar days after discovery.

This is a general summary for educational purposes, not legal advice. Requirements depend on your specific circumstances and may change. Consult qualified counsel and the official HHS guidance. Source: HHS Breach Notification Rule (hhs.gov).