A dental group's HIPAA security program: risk analysis, business associate agreements, immutable backups and multi-factor authentication
A dental group of 6 offices with about 70 staff, a practice management system and several outside vendors that touch patient data.
- Scale
- ~6 offices, ~70 staff, ~15 vendors, 1 immutable backup copy
- Engagement
- 6 weeks to build, then a yearly review
The challenge
The group had a written privacy notice and little else. It had never completed a risk analysis, did not know which vendors held patient data or whether agreements were in place, backed up to a drive that sat on the same network as the servers, and used shared logins at the front desk.
A dental group wanted to know whether it could show a regulator, an insurer or a patient that it protects health information. The client is not named on this page, and this is an illustrative engagement that describes the kind of work our team does; details are composite. Dental practices are covered entities under HIPAA, and the vendors that handle their data are business associates.
The risk analysis came first, because the Security Rule requires one under 45 CFR 164.308(a)(1)(ii)(A). Our team listed every system that holds patient data: the practice management system, imaging, email, the phone system, the backup and the front-desk computers. Each risk was rated by likelihood and impact, which produced a ranked list with an owner and a due date for each item. The analysis is a dated document, and it is repeated each year and after major changes.
Vendors came second. Many outside companies touched patient data, and several had no business associate agreement. A business associate agreement is the contract that obliges the vendor to protect the data and to report incidents. Each vendor was classified, agreements were signed or replaced, and vendors that would not sign were put on a list for replacement. Our team does not give legal advice, so counsel reviewed the agreement template.
Technical safeguards focused on the failures that stop a dental office from seeing patients. Backups moved to an encrypted copy that is immutable for a set period, in object lock storage or offline, so ransomware that reaches the network cannot delete it. A restore was tested, and the time it took became the recovery objective the group plans around. Multi-factor authentication covers email, remote access and the practice management system, and the shared front-desk login was replaced with individual accounts, so access logs mean something.
The program closed with training and a plan. Staff learned to spot phishing and what to do with a lost device, and an incident response plan names who decides, who calls the insurer and counsel, and how breach notification deadlines are checked. The result is a program the group can explain, not a certificate. This is the work our team does under cybersecurity and managed IT services, and it is not legal advice.
What our team delivered
- A risk analysis of the systems that hold electronic protected health information, in line with 45 CFR 164.308(a)(1)(ii)(A), using the HHS guidance and NIST SP 800-66 as inputs
- A vendor inventory with a business associate agreement for each vendor that creates, receives, stores or transmits patient data, and a short review of each vendor's own security
- Backups with a copy that cannot be changed or deleted for a set period (object lock or an offline copy), encrypted, and a restore test with the time recorded
- Multi-factor authentication on email, remote access and the practice management system, and an end to shared front-desk logins
- Written policies, a workforce training session and an incident response plan, including the breach notification steps
- A dated risk register and evidence folder, reviewed every year and after major changes
Result
The group has a documented risk analysis, agreements with the vendors that need them and a backup it has actually restored. Staff sign in as themselves and know what to do when something goes wrong. This is an illustrative engagement, a modeled outcome and not a compliance certification.
Get this for your company
Related services with fixed prices and a written scope.
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
Callback within 1 hour, 24 hours a day, 365 days a year
$1,950 per incident
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
Report within 5 business days of kickoff
$1,000 per assessment
Managed IT and security (MSP)
One monthly price per team member: help desk, device management, patching, backup monitoring and security basics.
Onboarding starts within 10 business days
$100 per team member, per month
Show 2 more
Insurance-ready bundle
The three things cyber insurers and clients ask for most: an external assessment, a phishing simulation for 25 users and a disaster recovery plan.
Assessment report in 5 business days; plan draft in 15 business days
$5,400 per bundle, phishing simulation for 25 users
Managed security monitoring
Endpoint detection and response watched by our analysts, priced per device.
Agents deployed within 7 business days
$18 per endpoint, per month
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
Backup tiers: data lost versus time to recover
Recovery point objective (RPO) is how much recent data a restore loses; recovery time objective (RTO) is how long the restore takes. Faster tiers sit close to the production system and share its fate; slower tiers survive ransomware and site loss. The scale is logarithmic. Illustrative figures.
Every sign-in, verified
Staff sign in once, but behind the scenes the device, the identity, a phone approval and your access policy are all checked before any app opens, and strangers are turned away.
The evidence pack and who asks for what
Twelve artefacts a firm can show about its AI use, and the party that most often asks for each: an insurer at renewal, an auditor or client questionnaire, or a regulator. A typical pattern only; the exact list depends on the policy, framework and sector.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.