What Does HIPAA Require From a Dental or Medical Office’s IT?

HIPAA’s Security Rule applies to covered entities, including most healthcare providers that conduct covered electronic transactions, and to their business associates. Whether a particular dental or medical practice is covered depends on its circumstances.

This article is general information, not legal advice. For questions about your specific obligations, talk to your compliance advisor or attorney. The official guidance is published by the U.S. Department of Health and Human Services (HHS) Office for Civil Rights.

HHS proposed updates to the HIPAA Security Rule in December 2024. The current Security Rule remains in effect while that rulemaking proceeds. Check HHS’s Security Rule update page for the latest status. This checklist describes the current rule.

The checklist at a glance

Area	What to have in place	HIPAA reference
Risk analysis	Written, current risk analysis and risk management plan	Security Rule, administrative safeguards
Vendors	Signed BAA with every business associate	Privacy and Security Rules
Access	Unique user identification, appropriate access controls, audit controls and risk-based MFA	Technical safeguards
Devices	Appropriate device protections, encryption decisions documented as required, screen locks and supported software	Technical and physical safeguards
Email	Appropriate safeguards for transmitting ePHI, such as encryption or a secure portal	Transmission security
Backup	Separate, tested backups and a contingency plan	Administrative safeguards
Training	Regular security awareness training with records	Administrative safeguards
Facility	Locked server closet, visitor controls, device disposal	Physical safeguards
Breach response	Written incident and breach notification process	Breach Notification Rule
Documentation	Policies and records kept for six years	Security Rule documentation requirements

The full rule and HHS guidance are on the HHS Security Rule page.

Start with a security risk analysis

The Security Rule requires covered entities to conduct an accurate and thorough assessment of the risks to electronic protected health information (ePHI). It is foundational to selecting appropriate safeguards and managing security risks. Documenting the analysis and the resulting risk-management decisions is important for demonstrating compliance.

A useful risk analysis:

• Lists where ePHI lives: practice management and imaging software, workstations, servers, email, cloud services and backups
• Identifies threats, such as ransomware, lost laptops or a former employee who still has access
• Rates the likelihood and impact of each risk
• Records what you will do about each one, and by when

Review and update the risk analysis as needed, including when significant changes occur, such as new software, a new location or a security incident. An annual review is a practical schedule, although HIPAA does not prescribe a fixed review interval. HHS and the Office of the National Coordinator offer a free Security Risk Assessment Tool designed for small and medium-sized practices.

Sign business associate agreements

A vendor that creates, receives, maintains or transmits ePHI on your behalf will generally qualify as a business associate, unless an exception applies. This often includes your IT provider, cloud backup provider, email or fax service, and practice software vendor. HIPAA generally requires a written business associate agreement (BAA) with each business associate. HHS publishes sample BAA provisions. Keep a list of vendors and confirm you have a current BAA for every one that touches patient data.

Control who can access patient data

• Give each person a unique login. Shared front-desk logins make it impossible to know who did what.
• Grant only the access each role needs.
• Turn on multi-factor authentication for email, remote access and cloud systems.
• Set automatic screen locks on workstations, especially in operatories and exam rooms.
• Remove access the same day someone leaves.
• Enable appropriate audit controls and review relevant logs to detect unauthorized access or suspicious activity.

Protect devices and email

• Evaluate and document encryption safeguards. Under the current HIPAA Security Rule, encryption is an “addressable” implementation specification, not an unconditional requirement. The practice must determine whether encryption is reasonable and appropriate; if it is not, the practice must document its decision and implement an appropriate alternative when one is reasonable and appropriate. Properly encrypted data may also qualify for an exception to HIPAA breach notification requirements.
• Apply appropriate safeguards when transmitting ePHI outside the practice. Encryption or a secure portal may be appropriate, depending on the transmission method and the practice’s risk analysis.
• Keep Windows and practice software up to date, and retire systems the vendor no longer patches.
• Use appropriate endpoint protection on workstations and servers, with monitoring and response capabilities suited to the practice’s risks. Our cybersecurity services explain how these protections work.

Back up and plan for recovery

The Security Rule requires a contingency plan, including data backup, disaster recovery and emergency mode operation. For a practice, that means:

• Backups of the practice management database and imaging, kept separate from the main network
• Regular test restores, with the results written down
• A plan for seeing patients if systems are down for a day

See our backup and disaster recovery page for what a sound setup includes.

Train staff and document policies

HIPAA requires security awareness and training for the workforce. Short, regular sessions on phishing, passwords and handling patient information are a practical way to reinforce that training. Keep written policies, a record of who was trained and when, and retain HIPAA documentation for six years as the rule requires.

Physical safeguards in a busy office

Dental and medical offices are busy, open spaces, which creates physical risks that IT alone cannot fix:

• Restrict physical access to servers and network equipment using safeguards appropriate to the practice’s environment, such as a locked room or cabinet.
• Position front-desk screens so patients in the waiting area cannot read them, or use privacy filters.
• Control who can plug devices into the network in operatories and exam rooms.
• Wipe or destroy drives before disposing of old computers, copiers and imaging equipment, and keep a record. Many copiers store scanned images on an internal drive.

Imaging, practice software and older systems

Practices often rely on imaging equipment and software that run on specific versions of Windows. When a vendor has not certified a newer version, the practice is left running an operating system that no longer gets security updates. Microsoft ended support for Windows 10 on October 14, 2025, according to its end-of-support page.

If you cannot upgrade a system right away:

• Ask the vendor in writing for its supported upgrade path and date.
• Isolate the system on its own network segment with limited internet access.
• Document the risk and your plan in your risk analysis.

Ransomware and the healthcare sector

Healthcare is a frequent target of ransomware. HHS’s Health Industry Cybersecurity Practices (HICP) resources, developed through the 405(d) program, address threats such as phishing and ransomware and include guidance relevant to smaller healthcare organizations. HHS has also stated in its ransomware guidance that a ransomware attack involving ePHI is presumed to be a breach unless the practice can show a low probability that the information was compromised.

That makes practical safeguards, such as MFA, endpoint protection, patching and offline backups, important for compliance as well as operations.

A worked example

A four-dentist Omaha practice uses a cloud practice management system, local imaging on a server, and Microsoft 365 for email. A practical first-year plan might look like this:

1. Complete a risk analysis using the HHS SRA Tool, listing the server, workstations, email and cloud vendors.
2. Confirm which vendors qualify as business associates and obtain the required BAAs, including from the practice software vendor, IT provider, backup provider and Microsoft where applicable. Verify that the Microsoft services in use are covered by the applicable HIPAA BAA terms.
3. Give each staff member a unique login, enable MFA on email and remote access, and set screen locks.
4. Encrypt laptops, install EDR, and set up a backup of the imaging server that is kept off-site and tested quarterly.
5. Hold short quarterly training sessions and record attendance.
6. Write an incident response and breach notification procedure with contact names.

What to ask your IT provider

• Will you sign a business associate agreement?
• Can you help us complete or update our risk analysis?
• Is every device encrypted and running supported software?
• Where are our backups, can ransomware reach them, and when did we last test a restore?
• Who is alerted if EDR detects something, and how fast do they respond?
• What would you do in the first hour of a suspected breach, and how do you document it?

Know what to do if there is a breach

The Breach Notification Rule sets the steps when unsecured patient information is compromised:

• Notify affected individuals without unreasonable delay and no later than 60 days after discovering the breach.
• Report breaches affecting 500 or more individuals to HHS without unreasonable delay and no later than 60 days after discovery. Notify prominent media outlets serving the affected state or jurisdiction when the breach affects more than 500 residents of that state or jurisdiction.
• Log smaller breaches and report them to HHS within 60 days after the end of the calendar year.

If the breach happened at a vendor, the business associate must notify you, and you remain responsible for notifying patients. Nebraska also has its own data breach law (Neb. Rev. Stat. 87-801 to 87-808), which requires notifying the Nebraska Attorney General no later than the time you notify affected residents. See the HHS Breach Notification Rule and Neb. Rev. Stat. 87-803 for details. Have your incident response contacts, including your IT provider, insurer and attorney, written down before you need them.

How Cambium Data helps practices

Cambium Data has been serving Omaha businesses, including dental and medical offices, since 2009. We help practices put these safeguards in place, document them, and keep them working. Learn more about our cybersecurity services or our IT support for dental offices and medical offices, contact us, or call (402) 514-3200.

Sources

• HHS, The HIPAA Security Rule
• HHS, Breach Notification Rule
• HHS, Sample Business Associate Agreement Provisions
• HealthIT.gov, Security Risk Assessment Tool
• HHS 405(d), Health Industry Cybersecurity Practices
• Nebraska Legislature, Neb. Rev. Stat. 87-803

Frequently asked questions

Is there such a thing as HIPAA-certified software or IT?

No. HHS does not certify products or vendors as HIPAA compliant. Compliance depends on how your practice uses and safeguards its systems.

Do small practices have to follow the same rules as hospitals?

Yes, the Security Rule applies to covered entities of every size, including small practices. The rule allows flexibility in selecting reasonable and appropriate safeguards based on factors such as the practice’s size, capabilities, resources and risks. The risk analysis helps justify those choices.

Does my IT provider need to sign a BAA?

If your IT provider can access systems containing ePHI, it is generally a business associate and needs a BAA.

How often should we do a risk analysis?

HIPAA does not set a fixed interval. Reviewing it at least yearly and after significant changes is a practical schedule.

Does every data breach require notifying patients?

No. HIPAA breach notification depends on whether unsecured protected health information was involved and whether an exception or a documented risk assessment supports a determination that the information was not compromised. Practices should involve their compliance advisor or attorney promptly when assessing a suspected breach.

TU

Tony Underwood

Founder, Cambium Data

Tony founded Cambium Data in 2009 and still leads the team. A Navy veteran with more than three decades in IT, he helps Omaha businesses run secure, dependable technology and put AI to practical use.

LinkedInsite.tonyunderwood.us