HIPAA risk analysis for a small dental office: a practical guide

Why it matters now

HHS's Office for Civil Rights has run a Risk Analysis Initiative focused on practices that never completed an accurate risk analysis, and small dental and medical offices have been among the settlements. Missing or out-of-date analysis is one of the most common findings. See what OCR expects from small practices.

Where patient data lives in a typical small dental office

• Practice management and charting software, on a server in the back or in the cloud.
• Imaging: the PCs that run X-ray and intraoral cameras, which often run older software and are rarely updated.
• Front desk PCs used for scheduling, insurance eligibility, email and the occasional personal browse.
• Email and fax for referrals and insurance.
• Backups, local and offsite, and whether anyone has ever tested a restore.
• Wi-Fi, including the guest network in the waiting room and whether it is truly separate.
• Phones and tablets used for patient forms or texts.

What the analysis produces

1. An inventory of systems that hold ePHI.
2. Realistic threats (ransomware, a stolen laptop, a phishing click, a vendor breach) and the weaknesses that make them likely.
3. A risk rating for each, based on likelihood and impact.
4. A prioritized plan: usually multi-factor authentication, separating the imaging and guest networks, tested backups, and updates.
5. A date to review it again, at least yearly and whenever you add a system, move, or change vendors.

HHS offers a free Security Risk Assessment Tool that some offices use as a starting point. Keith Systems can work with it or alongside it.

Example: a two-dentist practice in Santa Maria

Two dentists, five staff, cloud practice software, two imaging PCs on the same network as guest Wi-Fi, and a backup drive nobody has checked in a year. The analysis would flag the flat network, the untested backups and the shared front desk login as the top three, with a plan the office's IT vendor can carry out over a few weeks.

See HIPAA security risk analysis and ransomware readiness for dental offices.