Security that holds up on a Monday morning

Most dental practice security incidents start this way. Not with a targeted attack on a dentist, but with one ordinary click, on an ordinary morning.

What HIPAA-aligned means here

There is no HIPAA certification. A product or a provider described as "HIPAA certified" is describing something that does not exist. HIPAA is a law, and the Security Rule sets out administrative, physical, and technical safeguards for electronic protected health information.

HIPAA-aligned means the technical safeguards in the Security Rule are implemented and documented in your environment: access control, audit controls, integrity, person or entity authentication, and transmission security. Your practice remains the covered entity. We implement and maintain the technical controls, help you produce the evidence a risk analysis needs, and say plainly where a decision belongs to you or to your attorney.

Identity and access

Every person has their own account. Shared logins make the audit trail useless and make offboarding unreliable. Multi-factor authentication covers email, remote access, and the cloud services that reach patient data. Administrative rights stay with the people who need them.

When someone leaves, access ends on their last day, not when someone remembers.

Endpoints

Workstations and servers get endpoint protection that is monitored, full-disk encryption, patching, and a screen lock. USB ports are controlled where removable media is not part of the workflow. Imaging workstations get the same treatment, with the compatibility testing that imaging requires.

Encryption is listed as addressable under the Security Rule. Addressable does not mean optional. It means you implement it or you document why you did not.

Network separation

Guest Wi-Fi is not the network the practice-management server sits on. The imaging archive and the practice-management system are kept away from guest devices and from the internet-connected equipment that accumulates in a practice: televisions, thermostats, printers, personal phones, the waiting room tablet.

On a flat network, one compromised laptop can reach every server in the building.

Email

Filtering catches the obvious. The rest depends on configuration and on people knowing what to do. We set up sender authentication (SPF, DKIM, DMARC), limit what attachments and links can do, and give staff one simple action when something looks wrong: report it, do not forward it.

A reported click is a good outcome. A hidden one is not.

Business Associate Agreements

If a vendor touches protected health information, the practice needs a Business Associate Agreement with them. That includes cloud backup, IT support, the answering service, patient communication, billing, and software vendors who host data.

We sign an agreement with the practices we support. We also keep the list of the agreements you hold, because the obligation is not only to have them but to know which ones exist.

Incident readiness

The plan for the first hour matters more than the document in the drawer. Who to call. What to disconnect. Who speaks to patients and staff. How to preserve evidence. When to involve counsel on notification obligations.

When something happens, we tell you what we know, what we do not know, and when we will update you again.

The honest limit

No product prevents every breach, and no provider can promise zero incidents. Security is maintained, not installed. The realistic goal is fewer ways in, faster detection, a shorter recovery, and evidence that the safeguards were in place and working.

Where this meets the other elements

Security is the Fire element, and fire needs the other three to be sound. A backup that ransomware cannot reach is a security control as much as a recovery one. Network separation starts with the switches and firewalls in managed IT. The copy that survives is described in backup and recovery.