Dental Practice Cybersecurity: What to Fix First

In late August 2019, roughly 400 dental practices opened for the day and could not reach their patient records. The attackers had not broken into any of those offices. They had hit the company that managed the cloud behind the practices' backup service, then used that access to push ransomware to hundreds of its clients at once.

The service those dentists paid for to recover from a disaster became the disaster. That story shows how cybersecurity works for a dental practice now. The weak point is often outside your walls, and the fix is a short list of controls most offices can put in place this year.

Why do hackers target dental practices?

Dental offices hold exactly what cybercriminals want: patient data with names, birth dates, insurance details and often payment information. That identifiable information sells well and fuels identity theft for years.

Dental practices also tend to run lean. There is rarely a full-time IT person, and the practice management server may sit in a closet nobody checks. A hacker does not need to beat a security team when there isn't one.

What makes dental IT different?

A dental office looks like any small business until you count the equipment. Three things set dental IT apart, and each one creates its own vulnerability.

• Imaging workstations. Intraoral sensors, panoramic units and CBCT scanners each need a dedicated PC with vendor drivers. Those PCs often run outdated software on older Windows versions long after support ends, as our guide to Windows 10 end of support explains.
• Practice management software. Many offices still run their scheduling, charting and billing software on a local server. That one machine holds every patient record the practice has.
• Vendor remote access. Imaging, software and phone vendors often keep remote access tools installed for support calls. Each one is a door into your network that someone else holds the key to, and a route for unauthorized access if that vendor is breached.

Common cyber threats for a dental office

The threats themselves are the same ones every small healthcare office faces. The difference is how easily they reach a busy front desk.

• Phishing emails that look like insurance remittances, supply orders or lab notices.
• Stolen passwords reused across the practice software, email and personal accounts.
• Ransomware attacks that encrypt the server and every imaging PC on the same network.
• Vendor compromise, where malware arrives through a trusted support or backup connection.

Our guide to protecting patient data from ransomware covers the attack in depth. For a dental office, the priority is the order you close these doors.

What should a dental practice fix first?

These cybersecurity best practices are ranked by how much risk each one removes for the money. Your IT provider can complete most of them within a few weeks.

1. Turn on multi-factor authentication for email, practice management software and any remote access. MFA stops most attacks that start with a stolen password. Our MFA setup guide walks through it.
2. Keep one backup your vendors cannot touch. The 2019 attack went through the backup provider itself. Keep an offline or immutable copy, and test a restore every quarter.
3. Patch or retire old imaging PCs. Apply software updates on schedule, and move machines off unsupported Windows versions.
4. Separate your network. Put imaging devices, front-office computers and waiting-room Wi-Fi on different segments behind a business firewall.
5. Control vendor remote access. Remove tools nobody uses and require vendors to request access each time. Our guide to vendor risk management shows how to review them.
6. Run modern antivirus on every machine. Endpoint protection that watches for malware behavior catches attacks that signature-based antivirus misses.
7. Encrypt laptops and train your team. Encrypt any device that leaves the office, and run short phishing drills every month.

The HIPAA trap dentists keep falling into

Not every data breach involves a hacker. Some of the costliest HIPAA mistakes in dentistry happen in public, in reply to an unhappy online review.

The Office for Civil Rights has penalized several dental practices for answering reviews with patient details:

• A Texas practice paid $10,000 in 2019 after a Yelp reply revealed a patient's last name, condition, treatment plan and costs.
• A dental practice received a $50,000 civil money penalty in 2022 for a Google review reply that named the patient three times.
• A California practice paid $23,000 in 2022 after its Yelp replies revealed full names of patients who had posted under nicknames.

OCR's director put it plainly: "Providers cannot disclose protected health information of their patients when responding to negative online reviews." Confirming that someone is a patient is itself a disclosure.

The safe response is short and generic. Thank the reviewer, say privacy rules stop you from discussing care online, and invite them to call the office. Write that reply once, get it approved, and make it the only one staff may post.

Does practice size change your risk?

The controls are the same, but the exposure scales differently. A single-location office has one network, one server and one person who knows where everything is. When that person is out, security usually stops.

Group practices and dental service organizations (DSOs) share systems across locations. That makes one weak office a path into every other one. Our guide to multi-location practice IT covers how to standardize security across sites.

Do dental practices need cyber insurance?

For most offices, yes. A single ransomware incident can mean days without scheduling, imaging or billing, plus the cost of restoring data and notifying patients.

Expect insurers to ask detailed questions before they quote. They will want to know about MFA, backups, endpoint protection and your incident response plan. The fix-first list above is close to what underwriters check.

Doing it first improves your security and your odds of getting coverage on reasonable terms. Our cyber insurance buyer's guide explains what to look for in a policy.

Where to get more help

The American Dental Association publishes cybersecurity guidance for member practices. State dental associations, such as the California Dental Association (CDA), offer toolkits too.

Guidance only helps if someone owns the work. If nobody in your office has time to protect your practice day to day, our cybersecurity services handle it for small dental and medical offices.