HIPAA IT Checklist for Dental Offices

Every dental office that stores patient information electronically must protect it under the HIPAA Security Rule. The rule is written for all of healthcare, so it can be hard to tell what it means for a dental practice with a few computers, a server and an imaging system. This checklist turns the main requirements into practical IT steps.

This checklist is general information to help you plan. It is not legal advice; talk with your compliance advisor about your own obligations.

1. Complete a security risk analysis

HIPAA requires a risk analysis: a review of where electronic patient information is stored, how it moves, and what could put it at risk. For a dental office that includes the server, every workstation, imaging devices, backups, email, laptops and any cloud services. Update the analysis when your systems change, such as a new server, a move or a new location.

2. Control who can access patient data

• Give every staff member their own login. Avoid shared front desk or operatory passwords.
• Use strong passwords, and turn on multifactor authentication for email, remote access and cloud systems wherever possible.
• Give each person only the access their job requires.
• Remove access the same day an employee leaves the practice.
• Set computers to lock automatically when no one is using them.

3. Keep every computer patched and protected

• Install operating system and software security updates promptly.
• Run managed antivirus and endpoint protection on every computer and server.
• Replace computers and servers that no longer receive security updates.
• Filter email to block phishing messages and dangerous attachments.

4. Encrypt patient data

Encrypt laptops, servers and backups that hold patient information, and use encrypted connections when sending it. Encryption is one of the strongest protections if a device is lost or stolen, and properly encrypted data can change how a lost device is treated under the breach rules.

5. Secure the office network

• Use a business-grade, managed firewall.
• Keep guest Wi-Fi separate from the network that practice computers use.
• Allow remote access only through encrypted connections, never through open ports.

Learn more about network security for dental offices.

6. Back up data and plan for emergencies

HIPAA requires a contingency plan, which includes data backups, disaster recovery and a way to keep operating during an emergency. For a dental office that means:

• Automatic backups of your practice management database, images and documents.
• An encrypted offsite or cloud copy in addition to any local backup.
• Daily checks that backups succeeded, and regular test restores.
• A written plan for what staff do if the server or internet is down.

See how we handle secure data backups for dental offices.

7. Sign business associate agreements

Vendors that create, receive, store or transmit patient information for your practice are business associates. That can include your IT provider, cloud backup service, practice management software host and email provider. Keep a signed HIPAA business associate agreement on file with each one.

8. Train your team

Most breaches start with a person: a clicked phishing link, a reused password or a lost laptop. Provide security awareness training when staff are hired and at least once a year, and keep a record of who was trained.

9. Log activity and keep records

• Turn on audit logging in your practice management software and on the server.
• Keep records of your risk analysis, policies, training and security decisions.
• Write down how staff should report a lost device or suspected breach.

Common questions

Is there an official HIPAA approval for dental offices or IT providers?
No. HHS does not approve or endorse practices or IT providers as HIPAA compliant. Compliance comes from having the required safeguards, policies and records in place and keeping them current.

Does our IT provider need to sign a business associate agreement?
Yes, if they can access systems that store patient information. Dental Technologies signs a HIPAA business associate agreement with every client.

How often should we review our safeguards?
Review them at least once a year and whenever your systems, locations or vendors change.

Want help putting these safeguards in place? Our cybersecurity and HIPAA-compliant IT services cover the technical side for you. Get a managed IT quote for your dental office.